News for hackers. Stuff that matters.
Re:Hacking Google by registeredcorn on Friday September 30, 2022 @11:36PM (#33043639)
>This is a clever way to recruit hackers into the Google Security team.

I can't help but wonder how effective something like this actually is. I'm trying to not be overly negative, even though I have nothing nice to say about the company. I just find it really hard to believe that anyone would be sincerely excited to work at a place like Google.

I mean, I'm sure the pay and benefits are good for the moment, but it just seems like an unethical move, you know? Drug dealers make tons of money, but it doesn't really entice smart or ethical people to the profession in large numbers. Is wrapping it in some shallow webpage supposed to push people over the edge for some queer reason?

Re:Hacking Google by danielheath on Friday September 30, 2022 @11:50PM (#33043713)
I mean, it's pretty easy to tell yourself google maps is a social good (because there are lots of good arguments that it is!).

Similarly, there are lots of reasons why improving the security of google is a good thing _even if_ you think google itself is evil.

Re:Hacking Google by Morgawr on Saturday October 01, 2022 @12:23AM (#33043848)
> Similarly, there are lots of reasons why improving the security of google is a good thing _even if_ you think google itself is evil.

Especially when you consider the fact that a lot of stuff that Google security researchers do directly affects and influences (for the better, I'd say) the current industry too. See: Project Zero team, etc.

Disclaimer: I work at Google. Opinions are my own, etc etc

Re:Hacking Google by hulitu on Saturday October 01, 2022 @01:27AM (#33044146)
> a lot of stuff that Google security researchers do directly affects and influences (for the better, I'd say) the current industry too. See: Project Zero team, etc.

Yeah, and a lot of stuff that Google security researchers do directly affects and influences (for the worse, I'd say) the current (and future) users.

Re:Hacking Google by saagarjha on Saturday October 01, 2022 @02:49AM (#33044521)
Perhaps. Security teams in general (including the ones at Google) are in the business of compromises. Sometimes they end up making the wrong ones. Many of the people I know who are at Google joined, at least in part, to be in a position to help the company do better.

Disclaimer: I work on security there.

Re:Hacking Google by bawolff on Saturday October 01, 2022 @12:21AM (#33043844)
Never mind google maps, its pretty easy to tell yourself google project zero is a social good.
Re:Hacking Google by MattGaiser on Friday September 30, 2022 @11:59PM (#33043756)
> Drug dealers make tons of money, but it doesn't really entice smart or ethical people to the profession in large numbers.

Assuming the ethical premise as given, you are really glossing over the difference in potential consequences between doing something unethical and something illegal. Specifically the part where the latter can leave you locked up for life.

Re:Hacking Google by registeredcorn on Saturday October 01, 2022 @10:26PM (#33052223)
That's a fair point.

Whether by ignorance, stupidity, or mere indifference I draw little distinction between ethics and legality. This isn't to say that there isn't a different, but rather that I mush both together because of the three points mentioned.

Generally speaking, just because something is legal should not make it right, in the same way that something being illegal, merely by the fact of it being written and codified, does not make it wrong. To put a point on it: I think that some of the actions that Google has taken should have and still should result in prison sentences. As far as I am aware, they have not. That being the case, I certainly would not classify a drug dealer who is not currently in prison being free of wrongdoing.

Re:Hacking Google by bawolff on Saturday October 01, 2022 @12:23AM (#33043849)
I think these sort of things are the security equivalent of a company having a really good engineering blog. It probably wont directly lead to new hires, but increases mind share in the long term.
Re:Hacking Google by registeredcorn on Sunday October 02, 2022 @07:58PM (#33061718)
I suppose that's a fair assessment. Thanks!
Re:Hacking Google by staticassertion on Saturday October 01, 2022 @12:20AM (#33043833)
> I just find it really hard to believe that anyone would be sincerely excited to work at a place like Google.

> but it just seems like an unethical move

Whether you can empathize with it or not you must realize that of course people are sincerely excited to work at Google?

As for the ethics, at Google security you may be in a position to have some of the largest impact on the most people's personal security. You can say "oh but Google sells ads based on that data" - OK, and you might have a serious problem with that, but the person who's making sure that malicious 3rd parties can't read the GMail accounts of journalists probably doesn't see that as a deal breaker.

A lot of people also don't have the luxury to make these choices based on a purely ethical basis. If you're sending money back to your family back home is it a straightforward ethical question of "well Google sells ads, so my family has to starve" ?

Re:Hacking Google by hulitu on Saturday October 01, 2022 @02:06AM (#33044312)
> but the person who's making sure that malicious 3rd parties can't read the GMail accounts of journalists

But the friendly 3rd party has no issue reading the GMail accounts of journalists. Remember the "Doctor" incident some months ago ?

Re:Hacking Google by staticassertion on Saturday October 01, 2022 @02:52AM (#33044542)
No, I don't know what you are referring to.
Re:Hacking Google by hulitu on Saturday October 01, 2022 @03:32AM (#33044761)
When dad got arrested because he sent pictures of his child to the doctor.
Re:Hacking Google by staticassertion on Saturday October 01, 2022 @04:18AM (#33044962)
Not trying to be an asshole but can you just provide a source and try to make a clear point? Otherwise this conversation is like pulling teeth.
Re:Hacking Google by cookie_monsta on Saturday October 01, 2022 @09:37PM (#33051903)
I'm guessing the story was this: https://archive.ph/78Pla

and the point is that it's cold comfort getting protected from MITM when the person protecting you openly acts as a MITM

Re:Hacking Google by staticassertion on Sunday October 02, 2022 @08:08AM (#33055203)
Yes, this is just how CSAM detection works.
Re:Hacking Google by cookie_monsta on Saturday October 01, 2022 @02:15AM (#33044346)
I suspect that if you work at Google you have plenty of other career options before reaching the point where your family has to starve.

And to the journalists out there who are hypothetically using gmail to communicate with confidential sources: please stop.

Re:Hacking Google by saagarjha on Saturday October 01, 2022 @02:54AM (#33044558)
Journalists can make personal choices but they are not always in a position to mandate the methods of communication used by the people they talk to. This is similar to why “use a dumb phone and never connect to the internet” is not a feasible solution for those targeted by state-sponsored attacks.
Re:Hacking Google by cookie_monsta on Saturday October 01, 2022 @06:06AM (#33045415)
The parent comment was about protecting journalists' inboxes. They are absolutely in a position to avoid using Gmail to secure their end of the communication and you would hope that they are well enough informed to steer their sources towards more private options, too.
Re:Hacking Google by staticassertion on Saturday October 01, 2022 @02:52AM (#33044549)
> I suspect that if you work at Google you have plenty of other career options before reaching the point where your family has to starve.

Not always.

> And to the journalists out there who are hypothetically using gmail to communicate with confidential sources: please stop.

Uh, no.

Re:Hacking Google by cookie_monsta on Saturday October 01, 2022 @06:08AM (#33045428)
> Not always

Really? What circumstances lead from someone going from Googler to unemployable?

> Uh, no

Uh... because it's the best option available?

Re:Hacking Google by staticassertion on Saturday October 01, 2022 @09:23AM (#33046417)
> Really? What circumstances lead from someone going from Googler to unemployable?

I didn't say unemployable. But maybe other jobs aren't paying as well or you don't have time to shop around.

> Uh... because it's the best option available?

It's a pretty good oen

Re:Hacking Google by cookie_monsta on Saturday October 01, 2022 @06:35PM (#33050796)
> maybe other jobs aren't paying as well or you don't have time to shop around

Sure, but there's a lot of distance between "I would have to take a pay cut" or "interviewing is time-consuming"(?) and "I have to do this or my family will starve to death". If that seems like a high bar to pass, that's the one that you set.

I'm not necessarily criticising people's choice to work for Google. I'm definitely not saying that every Googler should quit immediately. What I am saying is that there are people out there legitimately doing jobs because the only other option is their family going hungry. Silicon Valley software engineers are not in that category.

> It's a pretty good oen

But if we're talking about journalists' ability to protect the information and identity of their confidential sources (again, a bar that you set), of all the options available, Gmail is not a pretty good one. And if you are dealing with information whose security can affect people's lives and livelihoods, then "pretty good" isn't the sort of standard you should be working towards anyway.

Re:Hacking Google by staticassertion on Saturday October 01, 2022 @07:56PM (#33051310)
Of course. Many people are not supporting a starving family, many people can take other jobs. I'm only trying to demonstrate there is a grey area.

> But if we're talking about journalists' ability to protect the information and identity of their confidential sources (again, a bar that you set), of all the options available, Gmail is not a pretty good one.

I disagree. Gmail is an incredibly secure mail service and is a fine way to perform some communications - in particular, while something like Signal may be ideal, Gmail can have a much better UX around initial contact.

Even if it weren't, it really doesn't matter, journalists do use it and they are targeted. But again, journalists are just an example, there are hundreds of millions of people using gmail - protecting them is something one could very easily consider to be ethical.

Re:Hacking Google by cookie_monsta on Saturday October 01, 2022 @08:23PM (#33051471)
> I'm only trying to demonstrate there is a grey area

I'm not disputing that people are supporting their families. I'm not disputing that finding another job is a PITA. The grey area that I am trying to demonstrate is that every single Googler has more career options than "continue working for Google" or "let my family starve to death"

> Gmail can have a much better UX around initial contact

I have no idea what this means. An email is an email, no?

> there are hundreds of millions of people using gmail

No argument there. And I'm not saying that securing their inboxes isn't worthy work. My original comment was directed to the hypothetical journalists who use Gmail for professional communication - it had nothing to do with the hundreds of millions of other users. They should be using E2E encrypted communications with confidential sources and encouraging their sources to do the same. That's just part of being a responsible professional in that line of work.

Re:Hacking Google by staticassertion on Sunday October 02, 2022 @09:10AM (#33055596)
> I'm not disputing that people are supporting their families

Literally just the very post before by you:

> What I am saying is that there are people out there legitimately doing jobs because the only other option is their family going hungry. Silicon Valley software engineers are not in that category.

This is incoherent.

Whatever point you're trying to make is not coming across and doesn't seem important. The initial point I made was that "is anyone excited to work for Google?" is a hilariously naive point of view both in terms of the obvious fact that they often are, and also in terms of a basic ethical framework. I gave examples. Nitpicking them isn't important because there are a million other examples.

Re:Hacking Google by cookie_monsta on Sunday October 02, 2022 @12:44PM (#33057634)
> This is incoherent.

I'm sorry you're having trouble following this. I agree that the original "nobody could be excited about working for Google" is a weird and most likely wrong assertion. But answering it by inventing a sub-class of Google workers whose only options are a) keep working for Google or b) let their family STARVE TO DEATH is not very helpful.

My original comment: I suspect that if you work at Google you have plenty of other career options before reaching the point where your family has to starve. really said it all. You have every right to be contrary, but it's more interesting if you stick to the topic and don't introduce fanciful edge cases.

Yes, there are Googlers who are supporting their families. No, that is not their only option.

Maybe there are journalists using Gmail for what should be confidential communication. No, they should not be doing that.

Call that nitpicking if you like, that's fine. They seem like simple, fundamental points to me. This thing that you've done a couple of times in this thread of refusing to see a very simple point and then complaining that it isn't "coming across" doesn't really do much to progress the discussion.

Re:Hacking Google by UncleMeat on Saturday October 01, 2022 @09:19PM (#33051792)
I work at Google. Nice to meet you. My day job involves making security tools and systems freely available to the entire world in a way that makes Google exactly zero dollars and basically just exists to make the landscape of software a bit safer for everybody.

I can understand why some people wouldn't want to work at Google. I cannot understand how somebody couldn't understand how anybody would want to work at Google.

Re:Hacking Google by bananachips123 on Saturday October 01, 2022 @12:00AM (#33043761)
I'm curious as to the main reasons you believe that Google is an unethical and bad company. Is the tracking of all its users are doing the main reason or are there other things?
Re:Hacking Google by registeredcorn on Sunday October 02, 2022 @08:00PM (#33061730)
I'm not particularly interested in talking about such things. It's clear that we don't agree on that point, which is fine. My concern was (attempting to) focus more on the effectiveness of the program in question.
Re:Hacking Google by hulitu on Saturday October 01, 2022 @02:03AM (#33044292)
Do you legitimately think that this tracking is only used for improving the search engine and serving ads ? Just asking.
Re:Hacking Google by entropy47 on Saturday October 01, 2022 @05:32AM (#33045264)
What else do you think it would be used for? Are we talking about another capitalism pursuit, or do you think there's something darker going on?
Re:Hacking Google by milemi on Saturday October 01, 2022 @01:07AM (#33044052)
Google chat bots make more sense than this post, so maybe that’s your clue right there.
Re:Hacking Google by saagarjha on Saturday October 01, 2022 @02:51AM (#33044537)
Responding to comments that you think aren’t appropriate with your own invective is not particularly appropriate either.
Re:Hacking Google by milemi on Saturday October 01, 2022 @10:40AM (#33046902)
What is up with people here trying to sound like hectoring kindergarten teachers? The post wasn’t inappropriate, it was just nonsense.
Re:Hacking Google by saagarjha on Saturday October 01, 2022 @06:17PM (#33050652)
This was my polite way of saying “don’t reply to bad comments with even worse comments”.
Re:Hacking Google by milemi on Saturday October 01, 2022 @06:51PM (#33050920)
The irony of you repeatedly doing what you’re telling me I shouldn’t do is forever lost on you.
Re:Hacking Google by saagarjha on Saturday October 01, 2022 @08:05PM (#33051358)
I don't recall comparing your comments with a chat bot but go off. Or, well, I'd prefer it if you didn't. Sometimes my replies get people to stop but if you'd like to not be in that group I guess I can't stop you.
Re:Hacking Google by entropy47 on Saturday October 01, 2022 @12:00AM (#33043760)
What about Google do you think makes working there comparable to pushing drugs? Legitimately curious.
Re:Hacking Google by hulitu on Saturday October 01, 2022 @02:01AM (#33044287)
No respect for the end user from both. Google only cares about your data.
Re:Hacking Google by entropy47 on Saturday October 01, 2022 @05:36AM (#33045286)
This chain is pretty wild to me. I don't know if I'm just too pragmatic, too close to people whose lives have been ruined by drugs, or too much of a big tech apologist - but it seems impossible to me to draw any parallel between drug dealing and working at Google. And I'm just talking ethically - to say nothing of legally.

Maybe I'm a consequentialist and you're more of a deontologist? I see a big distinction between "I lost my money, my home and eventually my life" and "I feel my privacy has been infringed on at a conceptual level in the pursuit of ad sales". Do you think there are Google products out there that are actually harmful and ruining people's lives in a concrete way? I would love to hear about how, if yes.

The other interpretation is you have a much higher estimation of drug dealers than I do. No dramas with people dealing pot or pills, I'm talking meth and heroin.

Re:Hacking Google by version_five on Saturday October 01, 2022 @10:22AM (#33046757)
"Drug dealers" are the result of regulatory failure - the war on drugs, and a failure of government to provide proper healthcare. People want drugs - no doubt there are some unscrupulous, or evil drug dealers, but it's certainly not a question of some evil cabal poisoning society, it's rational market actors working to meet a demand. Don't hate the player, hate the game.
Re:Hacking Google by saagarjha on Saturday October 01, 2022 @02:50AM (#33044530)
No respect for the end user? Drug dealers can be some of the realest people out there :)