3 ms·
It depends on the details. A package whose README says: "This is an automailer to send the CEO of Google a friendly Hello, and politely request changes to the
by frognumber 4y ago
It depends on the details.
A package whose README says:
"This is an automailer to send the CEO of Google a friendly Hello, and politely request changes to the Bug Bounty program."
Which does exactly that, and nothing nefarious beyond that, would probably be okay. It's doing exactly what's advertised.
You want to avoid anything which uses words like "hack" or "compromise." Indeed, you can go out-of-the-way to point out it is explicitly not a "hack" or "compromise" under current Google policies.
- jotaen 4y agoI’d think that ship has sailed in this case. The author already publicly stated that they would be able to make the package do “something malicious” within Google if they wanted. So however they change it after the fact, they’d run the risk of being accused of malicious intent.
- frognumber 4y agoNo, I don't believe so. "Something malicious" would be very different than sending a proof-of-concept email. "Something malicious" might be, for example, snarfing up data, or having one engineer commit malicious code and having another one approve it. Indeed, the email could walk through malicious use-cases like these, which either leak customer data or damage Google infrastructure.