Slashdot Mirror
Hackers Find Use for Google Code Search
An anonymous reader wrote in to say that "Google has inadvertently given online attackers a new tool. The company's new source-code search engine, unveiled Thursday as a tool to help simplify life for developers, can also be misused to search for software bugs, password information and even proprietary code that shouldn't have been posted to the Internet, security experts said Friday.
"
Isn't the point of open source that anyone can fix the programs? If it can be used by attackers it can also be used by developers. This is a pretty pointless article anyway as it's not that easy to find security holes in programs - if it was that easy then the developers would have patched up the holes already.
only to those whose "security" in reality consists of not much - or even nothing - more than obscurity.
:%s/Open Source/Free Software/g
YTARY!
How is searching for something misuse of the search engine? I'd say that the Internet was misused by those who made the information public in the first place.
If you accidentally put something publicly available on a web page, it can be found, manually or by a search engine. This is really no different from how it has always been with text, images and anything else that you can put on the web.
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
I think previous posters got it wrong. They say the cracker access to the code is just as easy as anyone else's who can fix it. But a developer looks only for the code he's involved to, while the cracker is looking for any exploitable program. That, and although coders eventually search for security holes, he's goal is to build features. So, it indeed is making it easier for the crackers.
Which is a good thing, if you realize bad environment also leads to evolution. More bugs exposed, the more developers will fix them, and maybe one day software designers will get it right, stop using insecure programming language, and write safer code.
factor 966971: 966971
People need to stop blaming those that provide tools and research for their finding or their ability to find bugs and errors. It's not their fault. If you screw up and someone finds it, it's not their fault, it's yours. Take responsibility and deal with the consequences.
The people that make the problems usually cry that the entire world needs to tell them about their mistakes in a nice quiet, private way, so they can silently fix them and avoid any unnecessary damage. The reality of this, as we have seen time and time again, is that when they are informed of these problems, so often they go ignored for months and months. And then the issue is finally leaked and they cry you didn't give us enough time! No, it was your fault to begin with, it doesn't matter if someone else made your mistake worse, none of this would have hapened without you screwing it up to begin with. This is how the world encourages you to try harder to get it right the first time instead of tossing us crap and fixing it later.
In summary, anyone that fights against auditing tools clearly has a quality control or security issue they are unwilling to fix and are afraid to have exposed.
(The whole model of "sell crap, fix later" is broken from the get-go. That's why we have crappy software hustled to the store in "version 1.0.0" form and have to beg the authors for bug fixes for the next half year. Problem is they already have your money, and that upgrade is free, so why should they pour resources into a 1.1 when there's no more money to be made? It's a losing proposition if you don't intend to release a paid 2.0 later, or if you think you can sucker them a second time)
I work for the Department of Redundancy Department.
Today's "hacks" mostly go for widely spread software. Why? Simple. For maximum impact. There are, of course, still targetted attacks, but those targets tend to be machines and nets of high interest for the hackers. If you use insecure software there, you earned that hack well.
So the key target is to get access to as many machines as possible, to create spambots, to phish for information, in other words, the key target for attacks is the machine of the common man.
Now, which approach would be more fruitful? To find a neat exploit, find out which software contains it and then match it against the software usually used by Joe Average? Or to do it reverse, find out what Joe uses and find exploits in that software?
I think the recent revelation of buffer overflows in MS-Office and the Javascript exploit in the IE answers that question.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
About customer relations: I have heard it said that your most important customers are your current ones, so keep 'em happy, because they've already overcome the first hurdle between their money and your pocket: they decided to choose your product [or service] instead of another.
...]. They'd rather stick with you if you're keeping them happy. Plus, of course, your product is satisfying them, so that's the main reason they'd stick around, right?
If you keep them happy, they are more likely to be repeat customers than to shop elsewhere, I'm told, because shopping is, itself, a cost to them [time, effort, risk
Of course this depends a bit on the product... Music sellers know that music fans are fickle, and some businesses thrive on variety of choice [clothing?*], but software and computer gear vendors probably benefit more from maintaining current customers than marketing to find new ones to replace them.
In the context of your company, then, this advice suggests that you should keep them happy and make the changes they want, if it seems cost effective, taking into account the potential cost of replacing that customer.
In other words, it's not just the chance of referrals that make customers worth keeping. Even users whose needs are met can be pretty bitchy about software -- we can all relate to being angry at our tools -- so referrals might not be the best reason to value your current clients.
But since they are more likely to buy again from you, and since you don't have to spend marketing dollars to get them to make that first purchase decision, they are valuable for those reasons.
*I use the question mark because, as a computer geek and gearhead, I don't really know or care much about clothes.