3 ms·

Finding security issues in a website (or: How to get paid by Google)

69 points by twapi 16y ago

deleted 16y ago
[deleted]
riprock 16y ago
At the risk of being downvoted, here's a "conspiracy theory." Why did the ad block for firefox recently stop working for youtube and google sponsored video ads? Personally, firefox's superior ad block was the last thing preventing me from defaulting chrome. Maybe google engineers figured out a way around the ad block, who knows. Regardless, does anyone know an ad block that still takes care of the video ads?
- Jach 16y ago
  I had this happen to me several weeks ago, it turned out the blocking list I had subscribed to (EasyList) got switched with the new default "Fanboy's List". I had switched back and haven't been plagued by video ads since.
  - riprock 16y ago
    Yay thanks, that fixed it! Okay now I just sound like a stupid douchebag :) Hopefully this helps some other people too.
- SageRaven 16y ago
  You should give privoxy a try. Browser agnostic and very powerful if you have even the most rudimentary programming/HTML experience.
- andreyf 16y ago
  Maybe google engineers figured out a way around the ad block I can't imagine Google engineers trying to get around AdBlock. That would be evil (and, ahem, trivial). :-P
- dchest 16y ago
  The reason is simple: YouTube changed video pages, so that YouTube downloaders and adblocks stopped working.
tptacek 16y ago
Do not do this to random people's websites. Google is one of an enlightened few. You will be surprised how easy it is to piss people off just by looking for cross-site scripting; something innocuous you do is going to cause popups to appear for all their customers, and they're going to go ballistic. People have gotten into legal trouble doing this.
- fmavituna 16y ago
  Just for the record that Google announced that they allow certain checks - http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... (actually encourage and reward - better than people publicly releasing these for sure) but even for them many vulnerabilities are still out of scope. Otherwise as you stated this is illegal in almost all countries.

69 points by twapi 16y ago

deleted 16y ago

[deleted]

At the risk of being downvoted, here's a "conspiracy theory." Why did the ad block for firefox recently stop working for youtube and google sponsored video ads? Personally, firefox's superior ad block was the last thing preventing me from defaulting chrome. Maybe google engineers figured out a way around the ad block, who knows. Regardless, does anyone know an ad block that still takes care of the video ads?

Jach 16y ago
I had this happen to me several weeks ago, it turned out the blocking list I had subscribed to (EasyList) got switched with the new default "Fanboy's List". I had switched back and haven't been plagued by video ads since.
- riprock 16y ago
  Yay thanks, that fixed it! Okay now I just sound like a stupid douchebag :) Hopefully this helps some other people too.
SageRaven 16y ago
You should give privoxy a try. Browser agnostic and very powerful if you have even the most rudimentary programming/HTML experience.
andreyf 16y ago
Maybe google engineers figured out a way around the ad block I can't imagine Google engineers trying to get around AdBlock. That would be evil (and, ahem, trivial). :-P
dchest 16y ago
The reason is simple: YouTube changed video pages, so that YouTube downloaders and adblocks stopped working.

tptacek 16y ago

Do not do this to random people's websites. Google is one of an enlightened few. You will be surprised how easy it is to piss people off just by looking for cross-site scripting; something innocuous you do is going to cause popups to appear for all their customers, and they're going to go ballistic. People have gotten into legal trouble doing this.

fmavituna 16y ago
Just for the record that Google announced that they allow certain checks - http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... (actually encourage and reward - better than people publicly releasing these for sure) but even for them many vulnerabilities are still out of scope. Otherwise as you stated this is illegal in almost all countries.