6 ms·

I think it's sad that he had to resort to publicly releasing this exploit because he couldn't find a way to contact Google about it. In the past, when I've had

I think it's sad that he had to resort to publicly releasing this exploit because he couldn't find a way to contact Google about it. In the past, when I've had problems, I couldn't contact them either. They've done a great job at making sure there's no human contacts available. You have to post something in a public forum and hope they'll contact you. (They won't.)

deleted 15y ago
[deleted]
ssclafani 15y ago
Sending an email to security@google.com will result in a quick response. As part of their bug bounty program Google would have paid $1,000 for this bug if not more.
- aristus 15y ago
  The biggest problem when the 911 (and equivalent emergency services) was getting the word out there that it existed. It required a huge, years-long marketing campaign. Perhaps they should have inhouse ads targeted at keywords like "report vulnerability".
  - shadowfox 15y ago
    I wonder if large companies are willing to advertise to the general public the possibility that they could have vulnerabilities.
- elmomalmo 15y ago
  Hmm, which is more valuable, $1000 or #1 on HN?
  - mike-cardwell 15y ago
    $1000
  - TeMPOraL 15y ago
    Sometimes (not necessarily in this case) #1 on HN. Being noticed in the right place at a right time may proove to be much better for one's life than a quick money boost.
  - StavrosK 15y ago
    You can get both.
- mike-cardwell 15y ago
  That was my immediate thought when I read the article. "Wow, this guy just chucked away hundreds of dollars". Always check for a bounty program before you go and release information like this.
  - jc123 15y ago
    Google should probably still give this guy the bounty
    - mike-cardwell 15y ago
      One of the main reasons they have a bounty program is to prevent people releasing information about bugs before they have been fixed. I don't see why they should give him a bounty.
- dave1010uk 15y ago
  I emailed security@google.com when I found a security issue with Google +1 (http://news.ycombinator.com/item?id=2630355 http://news.ycombinator.com/item?id=2630355) but didn't get any response. I guess it's not really an issue for them.
- silverbax88 15y ago
  No, it won't. Trying to contact Google when I was working for a major corporation and TRYING TO GIVE GOOGLE MONEY resulted in the exact same issue as the OP, and this was in 2006, not 2011. The only way to get their attention was create a blog post about how I couldn't contact them.
michaelfairley 15y ago
I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.
- sirn 15y ago
  Because now you know the email is spelled "security@google.com", it would be easy to come up with search query that returns that email address after the fact. If you going by the instinct, search for "google bug report", ...I'm on page 20 and still couldn't find that email. (Personalize search turned off.)
  - nbpoole 15y ago
    Because the security email address is not a place for bug reports: it shouldn't be ranking for that query. If it did, the team would just be swamped with "bug reports" ;) Try searching for "google report security" or "security vulnerability google" and you'll find the right information.
    - TeMPOraL 15y ago
      Which is sad, because in this case we have a security vulnerability and a bug at the same time, so how one expresses that in a web search depends only on one's current mindframe and set of associations. Eg. when I hear "Google security" I imagine guys with guns, not a place for bug reports.
  - michaelfairley 15y ago
    Any company worth its weight that stands to lose big time from a security vulnerability will have a page with info on how to report it to them, and searching "[company name] security" will usually get you right to it. Disclosure is what you do after you've contacted them and not heard back. http://www.apple.com/support/security/ http://www.apple.com/support/security/ http://www.microsoft.com/security/msrc/report.aspx http://www.microsoft.com/security/msrc/report.aspx https://www.dropbox.com/terms/#security https://www.dropbox.com/terms/#security http://www.amazon.com/gp/help/customer/display.html/ref=hp_left_ac?ie=UTF8&nodeId=551434 http://www.amazon.com/gp/help/customer/display.html/ref=hp_l...
drivebyacct2 15y ago
It's obnoxious how hard it is to report bugs to Google. And posting in their forum is a joke anyway. Google's new two-factor authentication? Really neat right? Yeah, well, it's buggy and there is no way to report bugs for it. I posted in the forum and was received by crickets. I don't mind it most of the time, but when I have a real issue or something that is obviously broken and unnoticed, it sure is frustrating. edit: There's also no category for "generic login problems" or "Other". So I'm stuck posting it in Gmail.
- spooneybarger 15y ago
  My favorite has always been the google apps problems that tell you to contact support to get a resolution but you can only contact support if you are a paying customer. support is not google's strong suit.
  - sidman 15y ago
    I am a google apps paying customer and it took them 4 weeks to get my domain issue corrected ! In that time i wasnt able to get mail so i had to change my mail to use godaddy until they got back to me. When they finally did they said it was because my dns records were pointing to godaddy ! After 1 week of not getting mails i would say an alternative is required. I actually had a feeling that this would happen :) I really love google as a company, their products, api's, their talks and all the events they hold are so great, i have learnt alot, BUT man, when i couldn't access my mail as a paying customer and got the runaround for support for 4 weeks even though they said it was high on the priority list ... GRRR thinking about it just makes me mad. Anyway on a good note, after this issue everything is working fine and i guess aslong as you dont need support then everything is good :)
    - gcb 15y ago
      thanks, always avoided paying them because i thought the experience would be like that...
    - RexRollman 15y ago
      Sadly, from what I have read over the years, your experience is not a solitary one. I hope Google, at some point, will address their customer service issues.
andreyf 15y ago
http://goo.gl/vulnz http://goo.gl/vulnz
- VMG 15y ago
  wow - where did you find that?
- aw3c2 15y ago
  obfuscated link is https://www.google.com/appserve/security-bugs/new https://www.google.com/appserve/security-bugs/new

deleted 15y ago

[deleted]

ssclafani 15y ago

Sending an email to security@google.com will result in a quick response. As part of their bug bounty program Google would have paid $1,000 for this bug if not more.

aristus 15y ago
The biggest problem when the 911 (and equivalent emergency services) was getting the word out there that it existed. It required a huge, years-long marketing campaign. Perhaps they should have inhouse ads targeted at keywords like "report vulnerability".
- shadowfox 15y ago
  I wonder if large companies are willing to advertise to the general public the possibility that they could have vulnerabilities.
elmomalmo 15y ago
Hmm, which is more valuable, $1000 or #1 on HN?
- mike-cardwell 15y ago
  $1000
- TeMPOraL 15y ago
  Sometimes (not necessarily in this case) #1 on HN. Being noticed in the right place at a right time may proove to be much better for one's life than a quick money boost.
- StavrosK 15y ago
  You can get both.
mike-cardwell 15y ago
That was my immediate thought when I read the article. "Wow, this guy just chucked away hundreds of dollars". Always check for a bounty program before you go and release information like this.
- jc123 15y ago
  Google should probably still give this guy the bounty
  - mike-cardwell 15y ago
    One of the main reasons they have a bounty program is to prevent people releasing information about bugs before they have been fixed. I don't see why they should give him a bounty.
dave1010uk 15y ago
I emailed security@google.com when I found a security issue with Google +1 (http://news.ycombinator.com/item?id=2630355 http://news.ycombinator.com/item?id=2630355) but didn't get any response. I guess it's not really an issue for them.
silverbax88 15y ago
No, it won't. Trying to contact Google when I was working for a major corporation and TRYING TO GIVE GOOGLE MONEY resulted in the exact same issue as the OP, and this was in 2006, not 2011. The only way to get their attention was create a blog post about how I couldn't contact them.

michaelfairley 15y ago

I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.

sirn 15y ago
Because now you know the email is spelled "security@google.com", it would be easy to come up with search query that returns that email address after the fact. If you going by the instinct, search for "google bug report", ...I'm on page 20 and still couldn't find that email. (Personalize search turned off.)
- nbpoole 15y ago
  Because the security email address is not a place for bug reports: it shouldn't be ranking for that query. If it did, the team would just be swamped with "bug reports" ;) Try searching for "google report security" or "security vulnerability google" and you'll find the right information.
  - TeMPOraL 15y ago
    Which is sad, because in this case we have a security vulnerability and a bug at the same time, so how one expresses that in a web search depends only on one's current mindframe and set of associations. Eg. when I hear "Google security" I imagine guys with guns, not a place for bug reports.
- michaelfairley 15y ago
  Any company worth its weight that stands to lose big time from a security vulnerability will have a page with info on how to report it to them, and searching "[company name] security" will usually get you right to it. Disclosure is what you do after you've contacted them and not heard back. http://www.apple.com/support/security/ http://www.apple.com/support/security/ http://www.microsoft.com/security/msrc/report.aspx http://www.microsoft.com/security/msrc/report.aspx https://www.dropbox.com/terms/#security https://www.dropbox.com/terms/#security http://www.amazon.com/gp/help/customer/display.html/ref=hp_left_ac?ie=UTF8&nodeId=551434 http://www.amazon.com/gp/help/customer/display.html/ref=hp_l...

drivebyacct2 15y ago

It's obnoxious how hard it is to report bugs to Google. And posting in their forum is a joke anyway. Google's new two-factor authentication? Really neat right? Yeah, well, it's buggy and there is no way to report bugs for it. I posted in the forum and was received by crickets. I don't mind it most of the time, but when I have a real issue or something that is obviously broken and unnoticed, it sure is frustrating. edit: There's also no category for "generic login problems" or "Other". So I'm stuck posting it in Gmail.

spooneybarger 15y ago
My favorite has always been the google apps problems that tell you to contact support to get a resolution but you can only contact support if you are a paying customer. support is not google's strong suit.
- sidman 15y ago
  I am a google apps paying customer and it took them 4 weeks to get my domain issue corrected ! In that time i wasnt able to get mail so i had to change my mail to use godaddy until they got back to me. When they finally did they said it was because my dns records were pointing to godaddy ! After 1 week of not getting mails i would say an alternative is required. I actually had a feeling that this would happen :) I really love google as a company, their products, api's, their talks and all the events they hold are so great, i have learnt alot, BUT man, when i couldn't access my mail as a paying customer and got the runaround for support for 4 weeks even though they said it was high on the priority list ... GRRR thinking about it just makes me mad. Anyway on a good note, after this issue everything is working fine and i guess aslong as you dont need support then everything is good :)
  - gcb 15y ago
    thanks, always avoided paying them because i thought the experience would be like that...
  - RexRollman 15y ago
    Sadly, from what I have read over the years, your experience is not a solitary one. I hope Google, at some point, will address their customer service issues.

andreyf 15y ago

http://goo.gl/vulnz http://goo.gl/vulnz

VMG 15y ago
wow - where did you find that?
aw3c2 15y ago
obfuscated link is https://www.google.com/appserve/security-bugs/new https://www.google.com/appserve/security-bugs/new