3 ms·
> initially dismissed his discovery as “intended behaviour” before his tweets about it went viral, and the company acknowledged the error Google's security tea
by 8organicbits 3y ago
> initially dismissed his discovery as “intended behaviour” before his tweets about it went viral, and the company acknowledged the error
Google's security team seems to make mistakes like this more often recently. I know they've got an onslaught of reports and (lacking a real support system) the security report channel has become an alternate way to escalate non-security issues, so I don't envy the challenge.
- c7DJTLrn 3y agoThere was a blog post on HN recently about a guy's experience reporting an issue to Google and they got a similar dismissive WONTFIX in robotic corp-speak. Security researchers should have a direct hotline to actual employees (engineers) interested in solving security issues, not be forced to raise tickets for morons who want to close them immediately because they don't care enough to investigate. I'd wager that a lot of people don't even bother reporting unless there's a potential reward because of this kind of treatment.
- fragmede 3y agoOTOH, given bug bounty payouts, the sheer number of reports they get for real WAI not-actually-a-hack behavior must be exhausting. People just seeking a payout for every trivial thing. Which, tbc, this thing isn't.