News for hackers. Stuff that matters.

A comment on Google Is 2B Lines of Code, All in One Place. Parent comment

Re:Google Is 2B Lines of Code, All in One Place by kuschku on Wednesday September 16, 2015 @02:10PM (#10228587)
No, it’s not that they are unsuccessful, it’s that they are unable to maintain it properly. Already today they have tons of open security issues.

Or think about April 1st, when they set a Access-Control-Location: * header on google.com because someone wrote the com.google easteregg.

Read the post from the SoundCloud dude from yesterday to find out how to do software management properly (hint: modularization is everything)

[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by cwyers on Wednesday September 16, 2015 @02:31PM (#10228736)
Yes, I'm sure Google has a lot to learn from SoundCloud about how to deploy software at scale, like that time NASA got advice from Estes Industries on how to launch rockets.
[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by captn3m0 on Wednesday September 16, 2015 @02:29PM (#10228722)
Do you have a source for the easter egg security issue? Haven't read about it anywhere, and can't seem to find anything either.
[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by kuschku on Wednesday September 16, 2015 @02:34PM (#10228757)
Here is one: http://arstechnica.com/security/2015/04/no-joke-googles-apri...

The issue was that they wanted to load the page – with the user logged in, etc – on com.google. For this they implemented an explicit URL parameter that would allow this.

[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by magicalist on Wednesday September 16, 2015 @04:08PM (#10229471)
> Attackers could have seized on the omission of the X-Frame-Options header to change a user's search settings, including turning off SafeSearch filters

The horror!

[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by t0mk on Wednesday September 16, 2015 @02:22PM (#10228665)
link to the post?

Neither HN search nor Google search show anything to "modularization is everything".

[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by DanBC on Wednesday September 16, 2015 @02:25PM (#10228687)
Perhaps this?

http://philcalcado.com/2015/09/08/how_we_ended_up_with_micro...?

(That question mark is part of the URL)

[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by kuschku on Wednesday September 16, 2015 @02:29PM (#10228725)
Yes, exactly.

It explains how even in a small company modularization can help extremely. Now look at Google, where some issues (like the google.com april 1st XSS issue) were only fixed after outsiders mentioned it.

Usually internally the team responsible for that part should have cought that.

[ Parent | on HN ]
Re:Google Is 2B Lines of Code, All in One Place by bitmapbrother on Wednesday September 16, 2015 @05:19PM (#10229966)
Why don't you list those "tons of open security issues" ?
[ Parent | on HN ]