4 ms·
So a decade and a half ago there used to be the Google Search Appliance (no idea if it still exists). It was essentially a black (actually yellow) box with some
by IgorPartola 3y ago
So a decade and a half ago there used to be the Google Search Appliance (no idea if it still exists). It was essentially a black (actually yellow) box with some Google magic inside that let you have Google search on premises and for local documents you didn’t want leaving your data center back when people still had their own data centers.
One problem with this premise was that when the appliance was not working how it was supposed to, you couldn’t just log into it to fix it because the Google magic was secret. You needed one of their engineers to access it and figure out what’s wrong, but the wrinkle was that every appliance was installed in a different environment and almost certainly behind a firewall that was not easy to open for this process. So to bypass it Google did a very clever thing and added a dial up modem to the appliance. That way you could just go down to the rack, physically connect it to a phone line, and put it into a diagnostic mode where it would dial out to Google to start the remote session. No firewall rules, no unintentional leakage, no accidental logins from who knows where.
- jojobas 3y ago>No firewall rules, no unintentional leakage, no accidental logins No guarantee that the box won't poke for ways to break out either, or was there a pinky promise? I guess it was somewhat easy to disguise it, the search box is supposed to constantly poke around and index things, right?
- solatic 3y agoMy understanding of what the parent wrote is the phone line would be disconnected in the normal case - can't break out if it's physically disconnected.
- riobard 3y agoI wonder… wouldn't a physically disconnected ethernet cable work as well?
- anonair 3y agoThat design probably has more with phone network penetration rather than corporate firewalls. The most likely use case for on prem Google would be far away sites with no connectivity except a phone line
- IgorPartola 3y agoWe used it for intranet documents but I suppose it had multiple uses.
- jojobas 3y agoThe phone line is disconnected, but maybe some other link isn't. I mean it would be an extremely cool hack but I wouldn't be super-surprised to learn that google deployed some sort of exfiltration search technology in these boxes.
- mananaysiempre 3y ago> [A] search box is supposed to constantly poke around and index things, right? Amusingly enough, that was Snowden’s approach, at least they way he tells it.
- deleted 3y ago[deleted]
- Cacti 3y agoCorporate datacenters are still quite common.
- punnerud 3y agoImage of the box: https://www.wired.com/2012/10/google-search-appliance/ https://www.wired.com/2012/10/google-search-appliance/
- CalRobert 3y agoI remember interviewing for Google circa 2010 and they asked me to present on "How does Google make money?". At the time I went with "well aside from ads you have this funky search appliance" and I hoped that they'd find more non-ad ways to make money. They didn't hire me, but it seemed like a neat device.
- postexitus 3y agoErm - so as soon as it dials out, it could give a non-firewalled access to LAN, no? Maybe they also disconnected ethernet while connecting the phone cable, but not sure how effective they can diagnose a problem without the network in place.
- Bluecobra 3y agoPOTS is/was a requirement for remote/out of band access to AT&T network gear as well. I did run into a funny thing when they started to migrate T1/PRI's to fiber. They still insisted that they needed a dedicated POTS line but converted the underlying copper circuits to a single fiber circuit. I was able to work around this with a phone line adapter but if the underlying fiber circuit was down they would be screwed.
- threeio 3y agoI had one of those boxes, worked for a company that ran news and magazine publishing sites and we pushed all the data to them as opposed to rewriting our search on the sites.. they were pretty decent and seemed to also help our page rankings on the mothersite ;)
- supriyo-biswas 3y agoThis isn’t as uncommon as you’d think. AWS’s storage gateway, which is a caching NFS layer over S3, has a diagnostic mode which starts a reverse shell over 22/tcp.
- masto 3y agoSometime around 1999/2000ish, I built a sort of distributed database application. Early web app days, Perl and PostgreSQL on FreeBSD, and almost no JavaScript. It was for fairly sensitive data that the users were a bit squirrely about sharing, so the idea was that you stored all of the bits you owned on your local node, and you could send a remote query to the whole network and each node would execute it, notify the local owner of the data "hey, Sally wants a copy of this record", and they could choose whether or not to send it back. Some of these installations were located in the middle of nowhere, and in those days we couldn't count on Internet access of any kind. But the company happened to also own a dial-up ISP... so I came up with a system, which I'm kind of proud of even though it was quick a hack. We ended up piggybacking the whole thing on dial-up e-mail using GPG-encrypted attachments. A couple of times a day, each node would call into the ISP and do a standard POP3 and SMTP routine, processing incoming requests and dropping off outgoing ones. Because it wasn't important for it to be real-time, we made the whole thing work asynchronously with the customer only having to supply a phone line.
- phone8675309 3y agoThis feels like a perfect application for UUCP / NNCP.
- ebiester 3y agoDial up as a part of an appliance was a fairly established pattern. I remember working with IBM in 2007 and they had a tool for a fair number of products that was just about dialing in to a terminal. However, I don't think it dialed back to IBM - people just used the terminal over dialup.