5 ms·
I met Jon a few weeks ago and we talked about the possibility of this exploit. At the time I didn't believe that the folks at Google would miss something like t
by dtwwtd 16y ago
I met Jon a few weeks ago and we talked about the possibility of this exploit. At the time I didn't believe that the folks at Google would miss something like this.
It just goes to show you can't be too careful when interacting with today's cloud services.
- marshray 16y agoI'm not sure this implicates cloud in particular. I see it as a company that doesn't understand the difference between securing an operating system and securing a website. Which is especially bad considering the train wreck that is web security. Jon was apologetic that his bug was so 'lame' since, unlike operating systems, the web was generally not designed to be secure. "Web security" in general depends on the secure behavior of the web browser, which in turn depends on the security of the operating system, hardware, and so on. If you reverse the arrows in the architecture, as Android appears to have done with Marketplace, then the whole thing becomes much less stable.
- dtwwtd 16y agoYes of course not cloud in particular, but web services in general. It just gave me pause because if Google messed this up, how many other services with less man power that we trust with our data have similar vulnerabilities?
- marshray 16y agoApproximately all of them. IMHO, browsers' implementation of the web "security model" (I use the term loosely) is not the thing to base the security of your entire architecture on. But hey, who am I to argue with Google?