3 ms·

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: N

by stewx 3y ago

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.

djbusby 3y ago
Is it fixed now?
- stewx 3y ago
  Probably not.
- Dudester230602 3y ago
  Google? No, if anything, it's getting worse... They would need to miss more than just cloud and commercialised LLMs to be truly shaken I am afraid.
yard2010 3y ago
Sounds like ChatGPT..
chias 3y ago
That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue
- LeonM 3y ago
  That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.
  - kurthr 3y ago
    Provide a 90 day timeline for the release of exploit.
- planede 3y ago
  I wonder if you can string it further. You: We are OK to publish a blog post about it then, right? Google: ...
  - kstrauser 3y ago
    Alteration: I've written the blog, and I'm going to publish it on...
- ukuina 3y ago
  Well, it IS a known issue after you reported it to them in the first place! :-)
- butterNaN 3y ago
  I mean, technically it is a known issue now that they know about it ¯\_(ツ)_/¯
- actionfromafar 3y ago
  But it was known, the second time.
scrum-treats 3y ago
Same experience. Receive hot air and fluff from Google, then a few months later the head of TAO announces a "fix" to the vulnerability originally raised. Additionally, the first articles announcing the vulnerability tried to link it to Chinese/Russia hacking. Shove that propaganda directly back at yourself (i.e., Google; a US-based company). Google left the backdoor wide open for anyone to exploit, foreign and domestic. And, it was definitely exploited by both. Google has real issues. Not sure what happened after 2019, but it's not great.
matan-h 3y ago
I have an addition to this story: Me: here's a bug in Google Play Services. Google: Not a bug, working as expected, closing issue. Me: posted the bug on my blog, and it's get extensive media coverage. Google: It seems we were wrong! It is indeed a bug. We will return to you in a few weeks.

by stewx 3y ago

djbusby 3y ago

Is it fixed now?

stewx 3y ago
Probably not.
Dudester230602 3y ago
Google? No, if anything, it's getting worse... They would need to miss more than just cloud and commercialised LLMs to be truly shaken I am afraid.

yard2010 3y ago

Sounds like ChatGPT..

chias 3y ago

That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue

LeonM 3y ago
That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.
- kurthr 3y ago
  Provide a 90 day timeline for the release of exploit.
planede 3y ago
I wonder if you can string it further. You: We are OK to publish a blog post about it then, right? Google: ...
- kstrauser 3y ago
  Alteration: I've written the blog, and I'm going to publish it on...
ukuina 3y ago
Well, it IS a known issue after you reported it to them in the first place! :-)
butterNaN 3y ago
I mean, technically it is a known issue now that they know about it ¯\_(ツ)_/¯
actionfromafar 3y ago
But it was known, the second time.

scrum-treats 3y ago

Same experience. Receive hot air and fluff from Google, then a few months later the head of TAO announces a "fix" to the vulnerability originally raised. Additionally, the first articles announcing the vulnerability tried to link it to Chinese/Russia hacking. Shove that propaganda directly back at yourself (i.e., Google; a US-based company). Google left the backdoor wide open for anyone to exploit, foreign and domestic. And, it was definitely exploited by both. Google has real issues. Not sure what happened after 2019, but it's not great.

matan-h 3y ago

I have an addition to this story: Me: here's a bug in Google Play Services. Google: Not a bug, working as expected, closing issue. Me: posted the bug on my blog, and it's get extensive media coverage. Google: It seems we were wrong! It is indeed a bug. We will return to you in a few weeks.