Hacker News Reader

Comment by wccrawford | Hacker News Reader

I think it's sad that he had to resort to publicly releasing this exploit because he couldn't find a way to contact Google about it.

In the past, when I've had problems, I couldn't contact them either. They've done a great job at making sure there's no human contacts available. You have to post something in a public forum and hope they'll contact you. (They won't.)

View on HN

Sending an email to security@google.com will result in a quick response. As part of their bug bounty program Google would have paid $1,000 for this bug if not more.

The biggest problem when the 911 (and equivalent emergency services) was getting the word out there that it existed. It required a huge, years-long marketing campaign. Perhaps they should have inhouse ads targeted at keywords like "report vulnerability".

I wonder if large companies are willing to advertise to the general public the possibility that they could have vulnerabilities.

I emailed security@google.com when I found a security issue with Google +1 (http://news.ycombinator.com/item?id=2630355) but didn't get any response. I guess it's not really an issue for them.

No, it won't. Trying to contact Google when I was working for a major corporation and TRYING TO GIVE GOOGLE MONEY resulted in the exact same issue as the OP, and this was in 2006, not 2011. The only way to get their attention was create a blog post about how I couldn't contact them.

Hmm, which is more valuable, $1000 or #1 on HN?

$1000

You can get both.

Sometimes (not necessarily in this case) #1 on HN. Being noticed in the right place at a right time may proove to be much better for one's life than a quick money boost.

That was my immediate thought when I read the article. "Wow, this guy just chucked away hundreds of dollars".

Always check for a bounty program before you go and release information like this.

Google should probably still give this guy the bounty

One of the main reasons they have a bounty program is to prevent people releasing information about bugs before they have been fixed. I don't see why they should give him a bounty.

I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.

Because now you know the email is spelled "security@google.com", it would be easy to come up with search query that returns that email address after the fact. If you going by the instinct, search for "google bug report", ...I'm on page 20 and still couldn't find that email. (Personalize search turned off.)

Because the security email address is not a place for bug reports: it shouldn't be ranking for that query. If it did, the team would just be swamped with "bug reports" ;)

Try searching for "google report security" or "security vulnerability google" and you'll find the right information.

Which is sad, because in this case we have a security vulnerability and a bug at the same time, so how one expresses that in a web search depends only on one's current mindframe and set of associations. Eg. when I hear "Google security" I imagine guys with guns, not a place for bug reports.

Any company worth its weight that stands to lose big time from a security vulnerability will have a page with info on how to report it to them, and searching "[company name] security" will usually get you right to it. Disclosure is what you do after you've contacted them and not heard back.

http://www.apple.com/support/security/

http://www.microsoft.com/security/msrc/report.aspx

https://www.dropbox.com/terms/#security

http://www.amazon.com/gp/help/customer/display.html/ref=hp_l...

I don't think it's reasonable to expect most people not immersed in the proper culture to see this as a "security" issue. They'd agree with "vulnerability" if you suggested it to them, but "bug" is really the first word that comes to mind.

The list of Google email addresses, including security@google.com is TWO clicks away from the google.com homepage.

Footer -> About Google -> Contact Us

http://goo.gl/vulnz

obfuscated link is https://www.google.com/appserve/security-bugs/new

wow - where did you find that?

It's obnoxious how hard it is to report bugs to Google. And posting in their forum is a joke anyway. Google's new two-factor authentication? Really neat right? Yeah, well, it's buggy and there is no way to report bugs for it. I posted in the forum and was received by crickets.

I don't mind it most of the time, but when I have a real issue or something that is obviously broken and unnoticed, it sure is frustrating.

edit: There's also no category for "generic login problems" or "Other". So I'm stuck posting it in Gmail.

My favorite has always been the google apps problems that tell you to contact support to get a resolution but you can only contact support if you are a paying customer.

support is not google's strong suit.

I am a google apps paying customer and it took them 4 weeks to get my domain issue corrected ! In that time i wasnt able to get mail so i had to change my mail to use godaddy until they got back to me. When they finally did they said it was because my dns records were pointing to godaddy ! After 1 week of not getting mails i would say an alternative is required. I actually had a feeling that this would happen :)

I really love google as a company, their products, api's, their talks and all the events they hold are so great, i have learnt alot, BUT man, when i couldn't access my mail as a paying customer and got the runaround for support for 4 weeks even though they said it was high on the priority list ... GRRR thinking about it just makes me mad.

Anyway on a good note, after this issue everything is working fine and i guess aslong as you dont need support then everything is good :)

Sadly, from what I have read over the years, your experience is not a solitary one. I hope Google, at some point, will address their customer service issues.

thanks, always avoided paying them because i thought the experience would be like that...

Setting up your DNS is not really something Google should do for you. You should have had an IT pro who's done this sort of transition before, manage the move. You could have had this resolved in hours not weeks. I agree though Google support sucks, the key is to not depend on it.

I think you misread what the problem was.

What problems have you run into? I recently switched over to 2-factor auth and while it's working fabulously I'd be interested to learn about any problems I could run into.

Reply on news.ycombinator.com