3 ms·

I definitely commend the author for his work, but I think that there might have been a slight misunderstanding here. In his last email, the author talks about h

by turing 13y ago

I definitely commend the author for his work, but I think that there might have been a slight misunderstanding here. In his last email, the author talks about how public disclosure would "force" Google to fix the vulnerability. But I read Google's response as simply saying that they did not think the bug qualified for the program, not that they didn't intend to fix it. Then again, my reading is definitely influenced by my time at Google and how seriously my team took this sort of thing.

iamshs 13y ago
"we do not believe that there is a security sensitive change that needs to be done here." - Google's Kevin. I think this means Kevin said they are not going to change the code on their end. Also, author stated: "Even if this vulnerability doesn’t qualify for a reward, I strongly believe that it should be fixed promptly to protect end users." Do I read the intent behind this correctly. Please do correct me. Because, to be frank, me and labmate are peeved right now about this. Google Scholar is a functional way to spread awareness about own research, but Google's response got on my nerves pretty badly.
- turing 13y ago
  I think that quote could also be interpreted as saying that Google simply didn't see it as a change that qualified for the program, not that they weren't planning on fixing it. But again, I could be entirely wrong; I have no experience with either the team or the program. I just have a hard time imagining any of the engineers that I know there getting assigned a bug like this and clicking 'working as intended - will not fix'.
  - iamshs 13y ago
    Then I would ask why is this vulnerability not up for monetary compensation? http://www.google.ca/about/appsecurity/reward-program/ http://www.google.ca/about/appsecurity/reward-program/ It is a script that allows one to control behavior (even though in a limited way, but yet authentic way) of Google's web property. Why did they say that this was not a security sensitive issue? And why did the tone change upon seeing public disclosure looming? Anyways, I am not happy about handling of this situation. Good on Tom for being responsible, and the exploit did not wander into irresponsible hands. Because, within a day everybody on Google Scholar would have got this exploitable email.

by turing 13y ago

iamshs 13y ago

"we do not believe that there is a security sensitive change that needs to be done here." - Google's Kevin. I think this means Kevin said they are not going to change the code on their end. Also, author stated: "Even if this vulnerability doesn’t qualify for a reward, I strongly believe that it should be fixed promptly to protect end users." Do I read the intent behind this correctly. Please do correct me. Because, to be frank, me and labmate are peeved right now about this. Google Scholar is a functional way to spread awareness about own research, but Google's response got on my nerves pretty badly.

turing 13y ago
I think that quote could also be interpreted as saying that Google simply didn't see it as a change that qualified for the program, not that they weren't planning on fixing it. But again, I could be entirely wrong; I have no experience with either the team or the program. I just have a hard time imagining any of the engineers that I know there getting assigned a bug like this and clicking 'working as intended - will not fix'.
- iamshs 13y ago
  Then I would ask why is this vulnerability not up for monetary compensation? http://www.google.ca/about/appsecurity/reward-program/ http://www.google.ca/about/appsecurity/reward-program/ It is a script that allows one to control behavior (even though in a limited way, but yet authentic way) of Google's web property. Why did they say that this was not a security sensitive issue? And why did the tone change upon seeing public disclosure looming? Anyways, I am not happy about handling of this situation. Good on Tom for being responsible, and the exploit did not wander into irresponsible hands. Because, within a day everybody on Google Scholar would have got this exploitable email.