3 ms·

> The woman in question was fired from the security team for violating IT security policies: in her words, "All I did was make a popup to share the labor notice

> The woman in question was fired from the security team for violating IT security policies: in her words, "All I did was make a popup to share the labor notice Google has to share with its workers", something that Google seems to have recurrent problems with staff doing. In other words she was rewriting the contents of web pages to meet her own political objectives. This paragraph that you just wrote is one of those claims that are wrong and/or misleading

thu2111 6y ago
How? That quote comes from the person who was fired. She explained what she did because she's proud of it: she injected some code into a web page about unions and organising telling Googlers they had a right to organise. The Google security team is frankly deeply worrying at this point, and I say that as someone who used to work there on security related topics (but consumer account security, not internal). A small number of them have privileged access to mandatory Chrome extensions that are used for various security objectives, yet they seem to have no qualms about abusing them to advance their own political agendas. Moreover they don't recognise that this is a problem. Controlling Chrome extensions that can inject JS into arbitrary websites equals root at google.com because everything they do is admin'd via web UIs. What if you're a law firm who advises companies faced with union action? Is it safe for you to use GSuite or whatever it's called today? My guess is no, because the people who ultimately control Google's IT infrastructure are (a) willing to break the most basic of IT security rules and then boast about it publicly, and (b) many of them are politically extreme by the standards of most of the world. Most astoundingly of all, I don't believe this is the first time Google has fired people for injecting JS into websites using internal security mechanisms to advance political agendas. In any normal company there'd be a mile of controls, processes and guard dogs surrounding any mechanism that could do this by now as it's been abused before. Apparently Google Security do not have their act together on this.
- berdario 6y ago
  > "All I did was make a popup to share the labor notice Google has to share with its workers" Does not mean rewriting the content of webpages, or having "root at google.com". It's better if you'd stop such speculation. The reality is much more pedestrian than what you describe: the person that was retaliated against only wrote simple, inert, strings of plain text. That text was not injected anywhere, and there was no arbitrary code involved. In fact, everything was safe, and went through the usual security controls. The only "danger" in having that, is that people can read it. Ultimately, it's laughable how you think that informing other coworkers about the NLRB is some kind of politically extreme agenda. It's clear that you have an axe to grind
  - thu2111 6y ago
    It went through the usual security controls yet she was immediately fired for doing it? Really? Do you understand how that sounds? Please do explain how someone makes a message appear in your browser when you visit a particular website, without having access to a highly privileged browser extension? That can at minimum monitor the URLs you're visiting? I honestly really hope you aren't on the Google security team, because you seem to be missing the issue here. Someone who had a high level of access was fired for violating basic trust, apparently with the collaboration of her coworkers. What other things could this person have done to advance her political goals by subverting her access for things it wasn't meant for? Outsiders can't know. All they can see is that the company doesn't have a grip on its own workforce. That is not confidence inspiring.
    - berdario 6y ago
      > it went through the usual security controls yet she was immediately fired for doing it? Really? Do you understand how that sounds? Yes, that's crazy... And that's exactly why people have been angry at the retaliation > Please do explain... To get more details, the appropriate thing to do is to draft a post that explains how these things are accomplished at Google and get it approved for publication by the legal review team. I've never done it and, while I don't exclude that I might do it, it probably won't happen soon.
      - thu2111 6y ago
        Argh, being fired for this isn't crazy. What kind of "security control" allows changes to security systems that aren't for the purposes of improving security? Whatever controls you're talking about are clearly not controls of the sort a normal auditor would recognise.

thu2111 6y ago

How? That quote comes from the person who was fired. She explained what she did because she's proud of it: she injected some code into a web page about unions and organising telling Googlers they had a right to organise. The Google security team is frankly deeply worrying at this point, and I say that as someone who used to work there on security related topics (but consumer account security, not internal). A small number of them have privileged access to mandatory Chrome extensions that are used for various security objectives, yet they seem to have no qualms about abusing them to advance their own political agendas. Moreover they don't recognise that this is a problem. Controlling Chrome extensions that can inject JS into arbitrary websites equals root at google.com because everything they do is admin'd via web UIs. What if you're a law firm who advises companies faced with union action? Is it safe for you to use GSuite or whatever it's called today? My guess is no, because the people who ultimately control Google's IT infrastructure are (a) willing to break the most basic of IT security rules and then boast about it publicly, and (b) many of them are politically extreme by the standards of most of the world. Most astoundingly of all, I don't believe this is the first time Google has fired people for injecting JS into websites using internal security mechanisms to advance political agendas. In any normal company there'd be a mile of controls, processes and guard dogs surrounding any mechanism that could do this by now as it's been abused before. Apparently Google Security do not have their act together on this.

berdario 6y ago
> "All I did was make a popup to share the labor notice Google has to share with its workers" Does not mean rewriting the content of webpages, or having "root at google.com". It's better if you'd stop such speculation. The reality is much more pedestrian than what you describe: the person that was retaliated against only wrote simple, inert, strings of plain text. That text was not injected anywhere, and there was no arbitrary code involved. In fact, everything was safe, and went through the usual security controls. The only "danger" in having that, is that people can read it. Ultimately, it's laughable how you think that informing other coworkers about the NLRB is some kind of politically extreme agenda. It's clear that you have an axe to grind
- thu2111 6y ago
  It went through the usual security controls yet she was immediately fired for doing it? Really? Do you understand how that sounds? Please do explain how someone makes a message appear in your browser when you visit a particular website, without having access to a highly privileged browser extension? That can at minimum monitor the URLs you're visiting? I honestly really hope you aren't on the Google security team, because you seem to be missing the issue here. Someone who had a high level of access was fired for violating basic trust, apparently with the collaboration of her coworkers. What other things could this person have done to advance her political goals by subverting her access for things it wasn't meant for? Outsiders can't know. All they can see is that the company doesn't have a grip on its own workforce. That is not confidence inspiring.
  - berdario 6y ago
    > it went through the usual security controls yet she was immediately fired for doing it? Really? Do you understand how that sounds? Yes, that's crazy... And that's exactly why people have been angry at the retaliation > Please do explain... To get more details, the appropriate thing to do is to draft a post that explains how these things are accomplished at Google and get it approved for publication by the legal review team. I've never done it and, while I don't exclude that I might do it, it probably won't happen soon.
    - thu2111 6y ago
      Argh, being fired for this isn't crazy. What kind of "security control" allows changes to security systems that aren't for the purposes of improving security? Whatever controls you're talking about are clearly not controls of the sort a normal auditor would recognise.