7 ms·
A team that handles security vulnerability reports should never say "oh - that's another internal team. Go ask them...". In fact almost any staff member inside
by andybak 3y ago
A team that handles security vulnerability reports should never say "oh - that's another internal team. Go ask them...".
In fact almost any staff member inside an organisation that receives a plausible vulnerability report should ensure it reaches the right people. It's not something you should shrug off.
- gear54rus 3y agoI assume that's the reason he just made a writeup about it instead.
- extheat 3y agoIt’s not really a vulnerability in the sense that it leads to any sort of system compromise. It’s definitely a design flaw in whatever features they added to the OS, but not necessarily something that warrants a huge investigation.
- andybak 3y agoI think anyone expecting these security-related features to work as expected would regard it as a vulnerability.
- dcow 3y agoThere are also just normal bugs and known limitations and acceptable risks.
- kllrnohj 3y agoIs parental lock really "security-related" ? Like it's a frustrating response to this valid bug report, but it's not really a security risk here, either. You don't actually bypass the lock screen or anything.
- andybak 3y agoI think it really is and could have serious safeguarding issues. Also other features are effected like kiosk mode etc. The implications are unclear but could conceivably be quite serious in some scenarios.
- kllrnohj 3y ago> Also other features are effected like kiosk mode etc Is it? That's not demonstrated nor claimed in the linked article. > I think it really is and could have serious safeguarding issues. Elaborate. What's the security risk from your child using a browser after the parental control timeout expired? It's annoying that the automatic limits didn't fully happen, but data isn't compromised as a result, either.
- ramses0 3y agoBrowse the open internet (or internal network?!) from a McDonalds ordering kiosk? No skin in the game, but this is very similar to the old Win95 "About... Help... $BROWSER" style bypasses.
- tigerBL00D 3y agoIf I read that correctly, in the second case someone can bypass the pinning feature to access your personal information via the default browser's active sessions. That would be a compromise if that's the case.
- JoshuaRogers 3y agoSure, it's not arbitrary code execution, but it's certainly privilege escalation.
- xuhu 3y agoThey have these exact phrases in their best practices list, but with no instead of any, and always instead of never.
- TeMPOraL 3y agoThe "that's another internal team" reply was presumably more about bounty than vulnerability itself. Still, my contrarian take: support - whether external customers or internal stakeholders - is a game of hot potato: first person that fails to forward it to someone else will get burned. It would be great if everyone was happy to drop whatever they're doing and lead resolution of customer's complaint, regardless of who the actual empowered/responsible person/team is. Alas, we live in the world where most people subscribe to Copenhagen Interpretation of Ethics. In this world, even forwarding a request to those responsible is dangerous. Anything more than that entangles you with the problem, meaning you'll be held responsible for it, no matter your actual connection to it. We can call it "principal-agent problem", or just "survival in the world where requesters are hunting for anyone willing to engage with their requests". (Source: I used to be the one willing to handle any internal request even tangentially related to my work, until my line manager told me to ask requesters for project ID or billing code before giving any help that requires more than 1 minute, because otherwise I'll end up doing none of the work we're actually being paid for.)
- smallmancontrov 3y agoYes, and the worst part is I don't think it's even a side effect of organizational structure because I've seen it in so many places. There is just a quirk of human psychology where "if you touch a problem it belongs to you now," and the result is a situation where everyone would be genuinely happy and eager to help but nobody (except the newbie) dares try because the consequences for trying are immediate and dire.
- xialvjun 3y agoSo, the future is Universal Basic Income and Open Source.
- skybrian 3y agoThis seems related to what I think of as the “jurisdictional hack.” Nobody can solve every problem, so you define a realm that’s your responsibility and anything outside it is someone else’s problem. Keeping your jurisdiction small means you can do more within that jurisdiction, by ignoring even important problems that are outside it. But the alternative is ineffective doomscrolling because all the world’s problems are yours.
- Xeamek 3y agoThey said 'go ask them' a out why they decided to close the issue (which also implies that someone went over this already), not 'go ask them because we simply don't care to look', as your comment seem to imply...
- andybak 3y agoThe result was the same. Someone was reporting a bad thing. The bad thing never got fixed.
- Xeamek 3y agoThis is too reductive. The 'we analyzed the issue and decided it won't be fix' Is NOT the same as 'we don't cate about this, go talk to some other team and maybe they'll fix it'. Deciding something is not a bug is not the same as just ignoring the bug and not fixing it
- andybak 3y agoIn this case it is - because someone outside the org - who has no responsibility for your company fixing it's stuff - is being asked to make sure the issue isn't lost. Google lost out in this case - because an employee pushed responsibility onto an outside party.
- dcow 3y agoWhat did they lose out on?
- qingcharles 3y agoGoogle is the king of "not my department." "No, I don't have contact with any other department within Google." "No, I don't have the email address of anyone on any other team in Google." WTF, Google?
- skirmish 3y agoIt's most likely because when you forward any internal information to any outsiders, you will get a stern dressing-down by your manager.
- r00fus 3y agoThat's the ultimate cop-out. There is a way you can expose coordination with internal teams and colleagues without "I've reached out to a colleague who has provided me with some additional context" or "this work requires some additional input from another team - I'm working to establish this and will get back to you with more details" Neither of the above examples provide any more context on internal teammates or their organizations. However they do require additional work and a culture of customer support (which Larry Page was infamously against for years).
- acdha 3y agoThat’s an explanation, not a cop out. It’s saying it’s a problem with management’s incentives and presumably not easily corrected before they have a good CEO.
- crdrost 3y agoSo having worked there, this was absolutely true, and the parent complaint about hot-potato is also absolutely true. The problem as I see it is that Google came to be dominated by an egalitarizing culture which at first wasn't necessarily a problem. This was an explicit choice by Larry and Sergey, that your manager should not be able to unilaterally fire you just because of a personal disagreement, nor stiff you out of financial rewards, none of that. So, your manager lacks any formal authority over your day-to-day work: they have to use politics and soft power. Instead, performance is reviewed by a committee of your manager’s peers, who can “calibrate” that manager’s opinion of you against others and against empirical data. The result of being judged by a faceless committee is that implicitly, some things generate the empirical data that they look at, and other things don't. It's helpful to oversimplify this to a common currency of “perfcoin” Ⓟ even though that was never explicit at Google. Some activities generate Ⓟ, some don't. Google has built dozens of new chat apps because whenever you can have a good excuse for how this aligns with your business priorities, they generate lots of Ⓟ. The design documents are rich in Ⓟ, the tracking issues for each feature are rich in Ⓟ, getting the thing privacy-analyzed and internationalized can get you some Ⓟ, the inevitable work to merge it into another chat app is also worth Ⓟ. But please understand that the existence of Ⓟ is a result of semi-hierarchy. The manager exists (hierarchy) but has to point to an objective measure (Ⓟ) to say that you're not doing what you're supposed to (semi-), it is almost a mathematical deduction that this has to exist given that structure. Now networking with people outside of your team, will never get you any Ⓟ. And this is not for lack of trying! When I was there it was a job responsibility to do some things that were not your job responsibility (“community contributions”) to try and associate Ⓟ with some form of networking! And everyone hated it, and it didn't work anyways. Manager-committees immediately decided that Ⓟ would not be awarded for excessive networking, just that you had to prove a little bit of networking or else Ⓟ would be deducted. Furthermore the most reliable community contributions were noncommunal—conducting hiring interviews being the easiest: probably this person will not be hired, but even if they are, you will never interact with this person ever again. But, you conducted N interviews in the quarter and that is just barely enough to not get docked some Ⓟ for being a shut-in. I am giving somewhat of a negative portrait and it is not all negative, see Laszlo Bock’s Work Rules for the better parts. I'm just saying that the culture of not-my-department has been created by, and is sustained by, incentivization.
- irrational 3y agoHow do you even find the right people? I have no idea how I’d do that at my company.
- dylan604 3y agoSend it to the CTO, the receptionist, or even HR. hell, CC them all with a note saying that it is unknown where to send it to so hoping someone will know where to forward it. It also sounds like your company needs better internal communication about communications within the company.
- dmazzoni 3y agoI worked at Google for many years. Google is so huge that it's extremely common to know you have an important bug for another team, but not to be able to route it to them because you can't find their team name. Most teams have "code names" that have nothing to do with the public name of the project. For example, the parental controls team might be named "pigglewiggle-team" and the Android contacts team might be named "katniss-team" and their bug components might have similarly obscure code names. If you don't work with those teams frequently it can be really daunting to find. Even when the bug components have hints that get you close to the right place, it's not unusual to learn that most of the engineers are busy working on the new version of the app that isn't released yet, and the old version of the app (the one with the bug) has been destaffed and bugs are supposed to be routed to some other random team that's literally never touched the code.
- irrational 3y agoSo, it isn’t just my company that does all of the above. I guess that’s good to know. At least we aren’t the only dysfunctional ones.
- dylan604 3y agoI think any company that has more than 1 employee leans towards dysfunctional