undefined | Better HN

0 pointskuschku10y ago0 comments

No, it’s not that they are unsuccessful, it’s that they are unable to maintain it properly. Already today they have tons of open security issues.

Or think about April 1st, when they set a Access-Control-Location: * header on google.com because someone wrote the com.google easteregg.

Read the post from the SoundCloud dude from yesterday to find out how to do software management properly (hint: modularization is everything)

0 comments

cwyers10y ago

Yes, I'm sure Google has a lot to learn from SoundCloud about how to deploy software at scale, like that time NASA got advice from Estes Industries on how to launch rockets.

captn3m010y ago

Do you have a source for the easter egg security issue? Haven't read about it anywhere, and can't seem to find anything either.

kuschkuOP10y ago

Here is one: http://arstechnica.com/security/2015/04/no-joke-googles-apri...

The issue was that they wanted to load the page – with the user logged in, etc – on com.google. For this they implemented an explicit URL parameter that would allow this.

magicalist10y ago

> Attackers could have seized on the omission of the X-Frame-Options header to change a user's search settings, including turning off SafeSearch filters

The horror!

oakhaven10y ago

link to the post?

Neither HN search nor Google search show anything to "modularization is everything".

DanBC10y ago

Perhaps this?

http://philcalcado.com/2015/09/08/how_we_ended_up_with_micro...?

(That question mark is part of the URL)

kuschkuOP10y ago

Yes, exactly.

It explains how even in a small company modularization can help extremely. Now look at Google, where some issues (like the google.com april 1st XSS issue) were only fixed after outsiders mentioned it.

Usually internally the team responsible for that part should have cought that.

bitmapbrother10y ago

Why don't you list those "tons of open security issues" ?

j / k navigate · click thread line to collapse

0 pointskuschku10y ago0 comments

No, it’s not that they are unsuccessful, it’s that they are unable to maintain it properly. Already today they have tons of open security issues.

Or think about April 1st, when they set a Access-Control-Location: * header on google.com because someone wrote the com.google easteregg.

Read the post from the SoundCloud dude from yesterday to find out how to do software management properly (hint: modularization is everything)

0 comments

cwyers10y ago

Yes, I'm sure Google has a lot to learn from SoundCloud about how to deploy software at scale, like that time NASA got advice from Estes Industries on how to launch rockets.

captn3m010y ago

Do you have a source for the easter egg security issue? Haven't read about it anywhere, and can't seem to find anything either.

kuschkuOP10y ago

Here is one: http://arstechnica.com/security/2015/04/no-joke-googles-apri...

The issue was that they wanted to load the page – with the user logged in, etc – on com.google. For this they implemented an explicit URL parameter that would allow this.

magicalist10y ago

> Attackers could have seized on the omission of the X-Frame-Options header to change a user's search settings, including turning off SafeSearch filters

The horror!

oakhaven10y ago

link to the post?

Neither HN search nor Google search show anything to "modularization is everything".

DanBC10y ago

Perhaps this?

http://philcalcado.com/2015/09/08/how_we_ended_up_with_micro...?

(That question mark is part of the URL)

kuschkuOP10y ago

Yes, exactly.

Usually internally the team responsible for that part should have cought that.

bitmapbrother10y ago

Why don't you list those "tons of open security issues" ?

j / k navigate · click thread line to collapse