Hacker News Reader

I think that quote could also be interpreted as saying that Google simply didn't see it as a change that qualified for the program, not that they weren't planning on fixing it. But again, I could be entirely wrong; I have no experience with either the team or the program. I just have a hard time imagining any of the engineers that I know there getting assigned a bug like this and clicking 'working as intended - will not fix'.

View on HN

Then I would ask why is this vulnerability not up for monetary compensation?

http://www.google.ca/about/appsecurity/reward-program/

It is a script that allows one to control behavior (even though in a limited way, but yet authentic way) of Google's web property.

Why did they say that this was not a security sensitive issue? And why did the tone change upon seeing public disclosure looming?

Anyways, I am not happy about handling of this situation. Good on Tom for being responsible, and the exploit did not wander into irresponsible hands. Because, within a day everybody on Google Scholar would have got this exploitable email.

Reply on news.ycombinator.com