Hacker News Reader

Comment by mrtksn | Hacker News Reader

So, this is basically using the Google bot as a proxy. I don't see what Google can do about it, or does Google have to do anything at all.

Just secure your website as if the attacker is not going to use the Google bot as a proxy, because well, nobody can guarantee that the attacker will use the Google bot.

Google bot is nothing more than a computer sending HTTP GET request to your server, so if your site is vulnerable to HTTP GET requests why you write like there is something special about Google bot?

View on HN

Well it would be nice if google could check the url it was visiting and if there is any sqli in it to not send the request (though this could potentially slow their crawling...)

Why? Do you want anybody but Google to hack your site? Why would Google spend resources on unnecessary detection of SQL injection(which probably will not be perfect anyway and may break legit requests) when anybody can hack your website?

I just can't justify why do you expect Google to spend resources on not running bogus HTTP GET request when anybody can run those? What is different about being hacked by Google bot and being hacked by an unsuspected user who clicks on a bogus link that was put on the same page where Google found that link to your server? Just doesn't makes sense.

> Just doesn't makes sense.

Not only that, but it seems to me that it'd be a more efficient use of resources to spend the time hardening your own site rather than lobbying Google to implement something that only mitigates one potential attack vector. Even then, it just seems stupid because I'm sure there are valid GET query strings that might have select, insert, update, delete, or some permutation thereof in them.

It seems to me that it's just a punt on poor programming habits...

How is Google supposed to check for what is/isn't "sqli"? The proposal reminds me of Yahoo! Mail's old "medireview" problem, where it filtered emails containing the string "eval":

http://en.wikipedia.org/wiki/Medireview#Blocked_emails

Even if you look for somewhat complete SQL strings, if I want to host http://try-sql-in-your-browser.io/?sql=select+foo+from+bar, I'd want Google to index it.

For a hilarious variant trying to protect against "attacks" on humans, use your favorite search engine to search for "buttbuttination".

Awesome, I had seen a few things in the wild like this, but this ended up in some fun reading. Thanks!

Well for one, we could make a standard query value that would say whether or not, the URL is evil.

http://try-sql-in-your-browser.io/?evil=true

It works well for IPv4.

Reply on news.ycombinator.com