5 ms·

doesn't google employ the elite of world programming? how can such stuff even happen? honest question.

Jaygles 6y ago
Probably due to the scale they're operating at. Maybe there were parts of things that didn't have such a vulnerability alone but did when put together. Maybe there isn't a clear owner of the code so no one felt responsible to find and patch such a thing. Maybe the entire system is too complex for one or even a small team of developers to grok so things can easily slip through the cracks from time to time.
bidirectional 6y ago
No, Google employs far too many developers for the median to be close to 'elite'. I'm sure there are elite teams at Google, but I very much doubt the average Googler is, and that's probably been the case for a decade at this point. The famous Rob Pike quote sums it up quite well: > The key point here is our programmers are Googlers, they’re not researchers. They’re typically, fairly young, fresh out of school, probably learned Java, maybe learned C or C++, probably learned Python. They’re not capable of understanding a brilliant language but we want to use them to build good software.
- xirbeosbwo1234 6y ago
  I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense to design an entire new language rather than offering new hires two months of training? Why are we pretending programming is a skilled trade when the things people actually wind up doing are so easy they can be learned in three months at a boot camp? Rob Pike is a legend. He is the man who brought us Plan 9. How is this what he wound up working on?
  - saddlerustle 6y ago
    The skills the median google engineer needs can absolutely be learned in three months at a boot camp but simultaneously those skills are worth a million a year to google. There's massive returns to scale of the infrastructure for effective software development, but very few organisations have figured it out.
    - NegativeLatency 6y ago
      having a near monopoly on online ad sales and search doesn’t hurt either
  - eternalsculptor 6y ago
    >can't understand generics Is this really true? We learned about generics in college so I assumed that everyone knew it (especially if they work at Google).
    - sascha_sl 6y ago
      OP is taking a swing at Go's lack of generics. Just because a language focuses on simplicity does not automatically make it bad. People use Go to solve complex issues, so it makes total sense none of that working memory should be occupied with understanding language features, even if they're as simple as generics. A more extreme way to write Go is "space shuttle style" Code, as used in the Kubernetes Volume Controller, a radically different approach to "I want all my complex features that I can use to shoot myself in the foot". You might be able to handle a firearm, but we have plenty of injuries and deaths through mishandled firearms every year, don't think you're exempt from that (or if you insist, at least do not talk down the need for safety). https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/volume/persistentvolume/pv_controller.go#L58 https://github.com/kubernetes/kubernetes/blob/master/pkg/con...
    - xirbeosbwo1234 6y ago
      As someone else noted, I am taking a swing at Go's lack of generics. More to the point, I am criticizing the reason for that. Designing a simple language is fine. I like simple languages a lot. Go was designed not because simple languages are good for some jobs but because Google decided their engineers aren't up to using more powerful tools. I don't know Go. I've only written about 200 lines of it. I don't pretend to know whether or not it's any good. What I do know is that the reasoning behind it is bizarre to me.
ossworkerrights 6y ago
WAANK doesn't always hire the best people. Most I interviewed from these were average. They did know how to solve high school algorithms tho.
bubblicious 6y ago
No evolving application can be or stay free of bugs or security concerns, regardless of the people or company behind it.
GoblinSlayer 6y ago
Only for the backend.
- gverrilla 6y ago
  isn't this backend?
  - GoblinSlayer 6y ago
    Looks like frontend: >Thankfully, YouTube has a solution for this as well, the YouTube Player API. This API allows you to just add a JS library to your site, and then simply create/modify/control the YouTube players on your site however you’d like, using JavaScript. For example, if you want to pause a video, you can just call player.pauseVideo().
xirbeosbwo1234 6y ago
I've learned to be suspicious of someone's reputation when I don't know what they've done to earn it. Everyone thinks Google employs the best engineers on the planet, but I suspect the reason most people believe that is just that everyone else does. How many people have actually come to believe that because they've done their homework? Google is an ad company. Their entire business model is based around manipulating public opinion. Don't trust a word you hear about them. Decide for yourself. Do the products Google makes look like they are made by the best engineers in the world? In my case, the answer is a resounding no.
kortilla 6y ago
> doesn't google employ the elite of world programming? Yes, some of them. But they are few and far between the tens of thousands of devs now that just glue services together with grpc and protos. The Google that produced cool shit just 7 years ago has grown like 10x in employees. Additionally, any engineer that has stayed that long is a millionaire several times over in stock and is very unlikely bothering with anything as boring as the embedded youtube player. Google is now IBM 25 years ago or so.
- pizza_shit 6y ago
  No it’s not. Did you completely miss the memo on google duplex, tensorflow, kubernetes, etc? G is still way more technologically advanced than any other top tech company, and is currently positioned at the top of the AI research ladder in many (if not all) sub disciplines
  - kortilla 6y ago
    Yeah, you’ve just described IBM 25 years ago. Lots of pockets of innovation in a sea of mediocrity. It wasn’t even that long ago that IBM was considered a top 5 company in cloud, AI, and quantum computing. > G is still way more technologically advanced than any other top tech company That’s a senseless statement. Google has lots of nice tooling for developers and managing their infrastructure, but that doesn’t make them the most “technologically advanced”. They use a mono-repo for a ton of stuff, most shit is boring grpc calls and regular database lookups. There is nothing on the leading edge of the crypto/blockchain world, there isn’t anything particularly interesting in p2p, etc. > Did you completely miss the memo on google duplex, tensorflow, kubernetes, etc? It’s funny you should mention kubernetes since most of the innovation there comes from outside of Google. Look at who is driving ebpf networking adoption, etc. You’re right though that Google is currently an AI leader. But again, that’s <1% of their engineering workforce. When I left a few years back most people were working on simple shit resting and vesting. It’s an incredible place to retire in place, but that will eventually catch up with them and it’s bad for career development as a SWE.
kevincox 6y ago
This seems something trivial to miss. The developer is asked to put the player into a page that has basically just the player and exposes and API. The API should allow playing videos and playlists. They do the obvious thing and it all works. The fact is that the security here wasn't the default. They need to explicitly realize that this allows the website to list playlists and consider that this should not allow listing the playlist with the user's credentials. This seems like an incredibly likely vulnerability to me and I am not surprised that even "elite" programmers missed it.
- CRConrad 6y ago
  > This seems like an incredibly likely vulnerability to me and I am not surprised that even "elite" programmers missed it. Was that a typo? Seems to me it should be an incredibly UNlikely vulnerability for "elite" programmers to miss it. If you meant that as written I don't understand it; please explain.
chubot 6y ago
Most bugs happen at the boundaries between what different people are working on. They're often process and architecture issues rather than programming issues. Security bugs often have this flavor.
jakearmitage 6y ago
I don't know, but they can solve binary trees on a whiteboard really fast.
rataata_jr 6y ago
Diversity hires must be catching up.

Probably due to the scale they're operating at. Maybe there were parts of things that didn't have such a vulnerability alone but did when put together. Maybe there isn't a clear owner of the code so no one felt responsible to find and patch such a thing. Maybe the entire system is too complex for one or even a small team of developers to grok so things can easily slip through the cracks from time to time.

bidirectional 6y ago

No, Google employs far too many developers for the median to be close to 'elite'. I'm sure there are elite teams at Google, but I very much doubt the average Googler is, and that's probably been the case for a decade at this point. The famous Rob Pike quote sums it up quite well: > The key point here is our programmers are Googlers, they’re not researchers. They’re typically, fairly young, fresh out of school, probably learned Java, maybe learned C or C++, probably learned Python. They’re not capable of understanding a brilliant language but we want to use them to build good software.

xirbeosbwo1234 6y ago
I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense to design an entire new language rather than offering new hires two months of training? Why are we pretending programming is a skilled trade when the things people actually wind up doing are so easy they can be learned in three months at a boot camp? Rob Pike is a legend. He is the man who brought us Plan 9. How is this what he wound up working on?
- saddlerustle 6y ago
  The skills the median google engineer needs can absolutely be learned in three months at a boot camp but simultaneously those skills are worth a million a year to google. There's massive returns to scale of the infrastructure for effective software development, but very few organisations have figured it out.
  - NegativeLatency 6y ago
    having a near monopoly on online ad sales and search doesn’t hurt either
- eternalsculptor 6y ago
  >can't understand generics Is this really true? We learned about generics in college so I assumed that everyone knew it (especially if they work at Google).
  - sascha_sl 6y ago
    OP is taking a swing at Go's lack of generics. Just because a language focuses on simplicity does not automatically make it bad. People use Go to solve complex issues, so it makes total sense none of that working memory should be occupied with understanding language features, even if they're as simple as generics. A more extreme way to write Go is "space shuttle style" Code, as used in the Kubernetes Volume Controller, a radically different approach to "I want all my complex features that I can use to shoot myself in the foot". You might be able to handle a firearm, but we have plenty of injuries and deaths through mishandled firearms every year, don't think you're exempt from that (or if you insist, at least do not talk down the need for safety). https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/volume/persistentvolume/pv_controller.go#L58 https://github.com/kubernetes/kubernetes/blob/master/pkg/con...
  - xirbeosbwo1234 6y ago
    As someone else noted, I am taking a swing at Go's lack of generics. More to the point, I am criticizing the reason for that. Designing a simple language is fine. I like simple languages a lot. Go was designed not because simple languages are good for some jobs but because Google decided their engineers aren't up to using more powerful tools. I don't know Go. I've only written about 200 lines of it. I don't pretend to know whether or not it's any good. What I do know is that the reasoning behind it is bizarre to me.

ossworkerrights 6y ago

WAANK doesn't always hire the best people. Most I interviewed from these were average. They did know how to solve high school algorithms tho.

bubblicious 6y ago

No evolving application can be or stay free of bugs or security concerns, regardless of the people or company behind it.

GoblinSlayer 6y ago

Only for the backend.

gverrilla 6y ago
isn't this backend?
- GoblinSlayer 6y ago
  Looks like frontend: >Thankfully, YouTube has a solution for this as well, the YouTube Player API. This API allows you to just add a JS library to your site, and then simply create/modify/control the YouTube players on your site however you’d like, using JavaScript. For example, if you want to pause a video, you can just call player.pauseVideo().

xirbeosbwo1234 6y ago

I've learned to be suspicious of someone's reputation when I don't know what they've done to earn it. Everyone thinks Google employs the best engineers on the planet, but I suspect the reason most people believe that is just that everyone else does. How many people have actually come to believe that because they've done their homework? Google is an ad company. Their entire business model is based around manipulating public opinion. Don't trust a word you hear about them. Decide for yourself. Do the products Google makes look like they are made by the best engineers in the world? In my case, the answer is a resounding no.

kortilla 6y ago

> doesn't google employ the elite of world programming? Yes, some of them. But they are few and far between the tens of thousands of devs now that just glue services together with grpc and protos. The Google that produced cool shit just 7 years ago has grown like 10x in employees. Additionally, any engineer that has stayed that long is a millionaire several times over in stock and is very unlikely bothering with anything as boring as the embedded youtube player. Google is now IBM 25 years ago or so.

pizza_shit 6y ago
No it’s not. Did you completely miss the memo on google duplex, tensorflow, kubernetes, etc? G is still way more technologically advanced than any other top tech company, and is currently positioned at the top of the AI research ladder in many (if not all) sub disciplines
- kortilla 6y ago
  Yeah, you’ve just described IBM 25 years ago. Lots of pockets of innovation in a sea of mediocrity. It wasn’t even that long ago that IBM was considered a top 5 company in cloud, AI, and quantum computing. > G is still way more technologically advanced than any other top tech company That’s a senseless statement. Google has lots of nice tooling for developers and managing their infrastructure, but that doesn’t make them the most “technologically advanced”. They use a mono-repo for a ton of stuff, most shit is boring grpc calls and regular database lookups. There is nothing on the leading edge of the crypto/blockchain world, there isn’t anything particularly interesting in p2p, etc. > Did you completely miss the memo on google duplex, tensorflow, kubernetes, etc? It’s funny you should mention kubernetes since most of the innovation there comes from outside of Google. Look at who is driving ebpf networking adoption, etc. You’re right though that Google is currently an AI leader. But again, that’s <1% of their engineering workforce. When I left a few years back most people were working on simple shit resting and vesting. It’s an incredible place to retire in place, but that will eventually catch up with them and it’s bad for career development as a SWE.

kevincox 6y ago

This seems something trivial to miss. The developer is asked to put the player into a page that has basically just the player and exposes and API. The API should allow playing videos and playlists. They do the obvious thing and it all works. The fact is that the security here wasn't the default. They need to explicitly realize that this allows the website to list playlists and consider that this should not allow listing the playlist with the user's credentials. This seems like an incredibly likely vulnerability to me and I am not surprised that even "elite" programmers missed it.

CRConrad 6y ago
> This seems like an incredibly likely vulnerability to me and I am not surprised that even "elite" programmers missed it. Was that a typo? Seems to me it should be an incredibly UNlikely vulnerability for "elite" programmers to miss it. If you meant that as written I don't understand it; please explain.

chubot 6y ago

Most bugs happen at the boundaries between what different people are working on. They're often process and architecture issues rather than programming issues. Security bugs often have this flavor.

jakearmitage 6y ago

I don't know, but they can solve binary trees on a whiteboard really fast.

rataata_jr 6y ago

Diversity hires must be catching up.