Hacker News Reader

Comment by lwansbrough | Hacker News Reader

Huh, honestly very strange to see something so niche and unbranded on the google.com domain.

It also looks to be completely uncompressed which is also rare across the web these days. Simply "Right Click > View Source".

rare sight of vanilla HTML and JS!

Back to that time where you could find some nice piece of code :

  useWackyUnit ? 'F' : 'C'

It would be funny if there was an exploit in there somewhere, since it seems to be using a completely personal stack and not whatever standard ones they have there

If you were going to run into an exploit it would be on whatever standard stack you run. A personal stack makes creating an exploit much more difficult and requires custom exploit development approach. Is the target worth the effort?

Use a common framework / stack don't update and you will likely be hit by an automated exploit.

I disagree. Using the framework developed by hundreds of talented google engineers will protect you against a large number of attacks. Also, if an attack already exists on the common google framework, then that means google.com is already vulnerable through other usages of the framework, and one more site does not increase your attack surface at all.

There are hundreds of thousands looking for a zero days bugs in bigger frameworks.

None for yours.

Wordpress is a great example. It has better security than your average php blog.

Your average php blog doesn't get attacked by automated exploits attacking known endpoints either.

A determined hacker would find it easier to buy an expliot to a common framework compared to figuring out your custom framework.

We've seen redis and mongo boxes getting hit by no password logins within seconds of going on the public web. Joe's custom cache and database doesn't get hit.

I don't disagree with anything you're saying. But my point stands that among two theoretical systems:

a) 10,000 users of a common framework + 1 user of a custom framework.

and

b) 10,001 users of a common framework

I contend that (a) has a larger attack surface than (b).

Reply on news.ycombinator.com