Forgot your password?
typodupeerror

Hackers Find Use for Google Code Search 176

Posted by CmdrTaco
from the thats-why-you-don't-comment-code dept.
An anonymous reader wrote in to say that "Google has inadvertently given online attackers a new tool. The company's new source-code search engine, unveiled Thursday as a tool to help simplify life for developers, can also be misused to search for software bugs, password information and even proprietary code that shouldn't have been posted to the Internet, security experts said Friday. "
This discussion has been archived. No new comments can be posted.

Hackers Find Use for Google Code Search

Comments Filter:
  • by strider44 (650833) on Sunday October 08, 2006 @09:27AM (#16354429)
    Isn't the point of open source that anyone can fix the programs? If it can be used by attackers it can also be used by developers. This is a pretty pointless article anyway as it's not that easy to find security holes in programs - if it was that easy then the developers would have patched up the holes already.
    • by julesh (229690) on Sunday October 08, 2006 @10:11AM (#16354629)
      But it is that easy. Back in the original slashdot article concerning the search tool, somebody posted a link to a result page that included a rather large number of php scripts that were vulnerable to SQL injections. Other common flaws should also be easy to search for.

      The problem is, not all developers perform this kind of search over their code. They may not even be aware that it's helpful.
      • by Bing Tsher E (943915) on Sunday October 08, 2006 @10:15AM (#16354649) Journal
        True but by making it easy for third-parties to search for this problematic code, it can hopefully be fixed and the original coders notified, before the faulty code is melded into the 'code infrastruture' deeply and in ways that make it more difficult to fix.

      • by imroy (755) <imroykun@gmail.com> on Sunday October 08, 2006 @11:27AM (#16355125) Homepage Journal
        ...somebody posted a link to a result page that included a rather large number of php scripts that were vulnerable to SQL injections.

        And you're surprised? Go to any site trying to teach programming in PHP and you'll likely find tons of vulnerable code. There seem to be very few PHP "programmers" who actually know anything about programming, let alone security. Most just copy from others (who copied from someone else, ad nauseum) and tweak. It will be quite a while before the amount of "secure" PHP code out there on the internet reaches critical mass.

        • Re: (Score:3, Insightful)

          by julesh (229690)
          Oh, yeah. My current day-job is as a PHP+javascript programmer. I know the messes of code you see from a variety of sources. I've read the textbooks and see how they instruct beginners down the path to security failure at every turn. You're preaching to the choir.
        • by Tim C (15259)
          There seem to be very few PHP "programmers" who actually know anything about programming, let alone security.

          That's mostly because PHP (and to a lesser extent ASP and JSP) is designed to allow semi-technical people to throw rapidly pages together. The trouble is, that's about as far as most people using it take it; thus you end up with vulnerabilities that are painfully obvious to those of us with a little more experience. It's 2006, not 1996; there is absolutely no excuse for producing code with SQL inject
          • by ukpyr (53793)
            Honestly, SQL injection and other vulnerabilities that come from trusting user data are far older that 1996. My first programming job was in 1996 and I was *fully* aware of perl's taint checking mode through documentation as well as peer review. I have had difficulty in even getting PHP developers to understand why SQL injection is scary.

            Most common response: "Who would try to do that?"...

            PHP:{Java, Perl, Python, Ruby, etc} as Frontpage:HTML

            I wonder if I got that formating correct. I'm sure you get the dri
            • Re: (Score:3, Insightful)

              by 1110110001 (569602)
              Show me how to write clean HTML in Frontpage, because I already know how to write clean code in PHP. Otherwise all or none of the languages should be on the same level as Frontpage, because none of them are safe against stupid programmers.
              • by ukpyr (53793)
                You miss my point, which is my fault. I'm not saying HTML generated from PHP isn't clean. I was focusing on the experience level of the person using it. Frontpage is for the "I wish a 'homepage'!", PHP is for the begining developer[1].

                Footnote 1: I relize there are many large sites using PHP with great success. Kudos. Seriously, Kudos. Why put yourself through that though?
                • And you're still wrong. Frontpage is for beginners and only for beginners. You can't use it to do "real" HTML.

                  But PHP is not only for beginners. Of course they like it because you don't need 10 lines of code for a hello world. But it's still a nice language if you write your large web applications and is maybe easier to use than other languages that weren't made for the web.
      • by n0dalus (807994)

        But it is that easy. Back in the original slashdot article concerning the search tool, somebody posted a link to a result page that included a rather large number of php scripts that were vulnerable to SQL injections. Other common flaws should also be easy to search for.

        To be fair, I'm sure some of those scripts [slashdot.org] aren't vulnerable. Some pages would have already checked the $_POST input for sanity before running the SQL. Also, for a while now PHP's default configuration has been to add slashes to $_POST/etc

        • Re: (Score:3, Insightful)

          by julesh (229690)
          Also, for a while now PHP's default configuration has been to add slashes to $_POST/etc input, so most of these scripts would be safe even if they are poorly written.

          Yeah. This works right until somebody asks "how do I get rid of all those \'s that turn up in stuff?" and the answer is "oh, disable magic_quotes_gpc." I've seen it happen before, and I'm sure it'll happen again. Relying on particular settings being enabled for security reasons in a disaster waiting to happen.
          • by n0dalus (807994)
            Yeah. This works right until somebody asks "how do I get rid of all those \'s that turn up in stuff?" and the answer is "oh, disable magic_quotes_gpc."

            If \' are turning up in stuff, then it means the script is doing its own addslashes or mysql_{real_}escape_string and hence wouldn't be vulnerable anyway. Of course, it's still a very bad coding practice, but my point was that not all the pages listed in that search page are vulnerable.

    • by asylumx (881307) on Sunday October 08, 2006 @10:23AM (#16354675)
      From the summary:
      ...even proprietary code that shouldn't have been posted to the Internet...


      Seems to me that it's NOT necessarily open source. Besides, Open Source isn't a magic bullet. "You found a bug in my open source app so you should fix it and upload a patch"... wow what a cop-out answer. If you think that anyone who uses any open source app is also a software developer... and a good one at that... well, no wonder Linux isn't more popular.

      I agree that it'd be nice if this article were actually an article though...
      • Re: (Score:3, Interesting)

        by Fordiman (689627)
        Actually, the 'many eyes' paradigm is what brings about things like BugZilla.

        OSS Devlopers like control over their code. Even if you see and fix a bug, they're most likely to go over your code and use it as an example of how to fix their code, rather than just patch it in verbatim.
      • "If you think that anyone who uses any open source app is also a software developer... and a good one at that... well, no wonder Linux isn't more popular."

        In the 90's I was working for IBM, the CEO made a speech and said "all software has been written, it just needs to be managed". All of the developers snickered, but the longer I stay in the bussiness the more it appears he was right.

        I have a BSc in computer science and have been contracting as a C/C++ developer since 1991, I "specialize" in Windows
    • by Dirtside (91468) on Sunday October 08, 2006 @10:32AM (#16354727) Journal
      Isn't the point of open source that anyone can fix the programs?

      That's one point. Another point is that if your company, for example, uses an open source application, you can hire someone to fix it instead of having to rely on the company that sells it.

      Yet another point is transparency -- being able to know WHAT the software is really doing, instead of having to trust the company that sells it.
      • "Never ever trust your fate to a black box when you are unaware of its contents" - the US Military.
        • by OmnipotentEntity (702752) on Sunday October 08, 2006 @12:46PM (#16355645) Homepage
          In practice the US Military does this quite a bit, unfortunately.

          It's actually kinda funny (read: ironic.) My roommate works on Jaam (actually, my roommate and his boss *are* Jaam,) and according to him, he's allowed to know far more about Red aircraft than he is about Blue. Why? Because info on Red aircraft were obtained through spying or diplomacy, information about Blue aircraft is tightly controlled by the companies that make them.

          And that's your daily dose of "our government is insane."
          • by Fordiman (689627)
            Not exactly. If the military is using a plane, they've had the high-rankingest of their own engineers go over the blueprints of that plane. While my GP post is true, keep also in mind that in the military, you are to explicitly trust your superiors' judgment. You may question it after the fact, but be prepared for some serious consequences if you're wrong.

            Meanwhile, what is 'Jaam'?
            • Stands for "Joint Anti-Air Model(?)"

              It's pretty much an aircraft simulator. Does simulations of dogfights and missles. Surface to Air, Air to Surface and Air to Air. That's pretty much all I know about it.
      • by xplenumx (703804) on Sunday October 08, 2006 @11:18AM (#16355061)
        I've come to believe that open source works if you're a programmer, but for the rest of the world the promises fall flat.

        I can't read code - it means absolutely nothing to me. So this whole point on OSS being transparent and knowing what the software really does, doesn't apply to me. Hell, if someone were to show me the source code to both Windows and Linux, I probably wouldn't even be able to tell which OS was which. All I care about is whether the software does what I need it to do; I don't plan on spending any evenings curled up to the fire reading source code.

        So this leads us to the next pro-OSS argument, that if the program doesn't do what you want you can either make a solution or hire someone to do it for you. I've tried this (several times in fact), and it didn't work. Since I don't program I have to go out and hire someone to code the solution I want. Never mind that finding a coder can often be a royal pain, but each and every time not only has (or would have) it been more expensive to hire someone to code the solution, but it took longer than had I gone out and bought a commercial closed source package (or two) that did do what I want.

        Lastly, I keep hearing how OSS programs are more nimble and should a bug or needed feature be identified, 'the community' will solve the problem much faster than a closed source solution. That may be for popular projects like Linux or Firefox, but in my experience I find the OSS programs to be less responsive to requests and needs than the closed source solutions.

        As a scientist, I'm all for transparency and free flowing information. However, when push comes to shove, I need programs that work, and, while I really hate to say this, the OSS programs have always fallen short.

        • by Skater (41976) on Sunday October 08, 2006 @01:03PM (#16355737) Homepage Journal
          I ran into a situation at work recently where we (note, we're statisticians, not programmers) discovered firsthand the value of having the source code to a piece of software. A proprietary program we purchased was calculating a value incorrectly because it wasn't taking a certain factor into account that most people don't need, and there was no way to get it to do that. My boss' comment: "And we can't fix it because we don't have the code."

          Her point was right on target - if we had the code, we could've easily contracted out fixing the program; it probably would've taken a competent programmer a couple hours to put the fix in and test it. But instead, we're stuck with a software package that's useless for many of the situations we wanted it for, unless the developer decides we're important enough to fix the software.

          When this happened, I realized that the general public is becoming much more aware of the potential problems with closed-source software. For now it might just matter mostly to programmers, but sooner or later, it'll matter to a lot more people, too.
          • by Draknor (745036) on Sunday October 08, 2006 @01:23PM (#16355835) Homepage
            Her point was right on target - if we had the code, we could've easily contracted out fixing the program; it probably would've taken a competent programmer a couple hours to put the fix in and test it. But instead, we're stuck with a software package that's useless for many of the situations we wanted it for, unless the developer decides we're important enough to fix the software.

            Just out of curiosity -- HAVE you contacted the developer asking for a fix? Just because its a closed-source solution you can't fix yourself, doesn't mean the vendor won't fix it if someone asks. Especially if its really as simple as a couple of hours (although there is always extra overhead, such as back-testing, etc.)

            Disclaimer: I work for a closed-source software vendor, but we try very hard to meet the needs of all of our customers, so if they identify a critical issue we generally try to either find an acceptable work-around, or patch the code when possible. And (ideally) that would be done in such a way that you won't lose that fix when you upgrade. If you custom-fix your OSS solution, you either have to never upgrade, or patch every version that comes out; that seems to be a lot of long-term hassle.

            Customer satisfaction is a big part of being a software vendor -- sure, you may be a small customer, but if my company is responsive to your needs then that builds good relations with you, and you may be an excellent referral source for us later (or become a larger customer yourself). That's a strong motivation for businesses that really care about their customers. And for professional-type products, buyers are more likely to pay extra for that good service.
            • Re: (Score:3, Insightful)

              by mooncaine (778422)
              About customer relations: I have heard it said that your most important customers are your current ones, so keep 'em happy, because they've already overcome the first hurdle between their money and your pocket: they decided to choose your product [or service] instead of another.

              If you keep them happy, they are more likely to be repeat customers than to shop elsewhere, I'm told, because shopping is, itself, a cost to them [time, effort, risk ...]. They'd rather stick with you if you're keeping them happy. Pl
              • by Draknor (745036)
                You make some very good points -- keeping your existing customers is an important goal in and of itself. And that's actually what my job is where I work: I work directly with our customers to provide technical guidance and programming support when they encounter a situation that doesn't work with our standard features / options. Basically, my job is all about keeping our existing customers happy, both to keep them and to provide good referrals & recommendations for our products to other potential cust
            • Just out of curiosity -- HAVE you contacted the developer asking for a fix? Just because its a closed-source solution you can't fix yourself, doesn't mean the vendor won't fix it if someone asks.

              Unfortunately not all closed source vendors are as helpful to their customers as your company. I once dealt with a problem in a closed-source accounting package, which could not handle a fairly simple way of grouping items together to be sold (selling a specified set of items as a "kit" at a reduced price). I contac
            • by pthisis (27352)
              The problem is that you're at the mercy of the vendor. Some are very good. Some don't care. Some may care, but for whatever reason (layoffs, turnover, old code, 3rd-party binary libraries) can't fix your problem.

              I've had at least one case where I was able to strace a vendor library, figure out the problem, send them a detailed description of the problem and solution--it was an obvious problem in the arguments to bind(2), which basically narrowed it down to 1 line of code for them and they _should_ have b
            • by sgt scrub (869860)
              Customer satisfaction is a big part of being a software vendor

              I, and hundreds of others, have contacted ATI about their software, drivers, not working properly on Linux. The OSS drivers march quickly towards fixing the problem with no information from ATI. However, ATI is slow and seemingly uninterested in fixing the problems we tell them about.
          • by mcrbids (148650)
            This is why I believe that hosted applications - software as a service - is the logical, commercial answer to OSS intrusion.

            You don't want to hire a software firm, you don't want to have the source, particularly. You want/need feature NNN. And that's where hosted software shines. It all comes down to motivation.

            If you BUY software, there's little incentive for the developers to fix bugs in it - there's no money in it. But a hosted application has a very different dynamic - if they fix the bugs that are trou
        • However, when push comes to shove, I need programs that work, and, while I really hate to say this, the OSS programs have always fallen short.

          Really? Ever use a Tivo? Ever go to a web site? How about Google? How about wikipedia? Do you have any idea how much BSD licensed code (math libraries, for example) might be running on your cell phone, your car stereo, etc?

          People don't know it but open source is everywhere and it works great. Sure, you're not using an OSS spreadsheet or word processor, but that doesn'
        • by kwalker (1383)
          Have you ever participated in any of these FOSS programs that you found lacking? Have you ever joined the mailing list? Ever just asked for a feature or explained a bug? The first time I did and it was implemented, I was surprised; the second time (Different project), I was gratified; the third time (Different project again), it cemented in my mind why I will always stick with FOSS projects, even those that aren't nearly as polished as their Shareware or Closed counterparts.

          I am a programmer and a system
        • Re: (Score:3, Insightful)

          by cdrguru (88047)
          Hear, hear. You have probably stumbled across one of the true secrets of computer programming.

          It is hard work.

          Lots of people don't get that at all. Lots of management types assume that because person A wrote this code in a week that person B should be able to fix it in a week. Not true at all.

          Sometimes it takes person B a week (or a month) to figure out what in the heck person A was doing. Open source is not immune to this. Hiring someone that was not involved in the original development of some random
        • by IpSo_ (21711)
          I like to relate open source software to the car industry. If a new car company was established that sold its car for a few thousand dollars less then everyone else, but the catch was the hood was locked shut and the only people with the key to it was the dealership themselves. Thus forcing ALL maintenance and repairs to be carried out by the original dealer at a premium. Do you think this company would survive? Would YOU buy a car from them?

          Most people would say, HELL NO! Even though MOST people don't have
          • Actually, your car is pretty closed architecture.

            Ford is bragging how they boosted the EPA gas mileage of the Ford Focus by 10 percent (actually the highway rating of the manual transmission model -- the mileage improvement on other models and for the city rating was less) by updating the software in the ECM. Not only does the 2007 Focus have this improvement, but they are flashing the memories of 2006 models to get the same effect.

            Now try making mods to your ECM for any purpose -- to boost gas mileage

        • My guess is that you do indeed write programs at some level. Do you use a stats package? A graphing package? Matlab? If you are using a graphics package with anything other than default settings and saving the results to a template file to recreate that type of plot, you are doing some type of programming. The same goes for writing scripts in Matlab.

          One solutions is to have a divide between "applications programs" and "systems programs". Back in the day applications were written in Fortran while sys

        • by bit01 (644603)

          I've come to believe that open source works if you're a programmer, but for the rest of the world the promises fall flat.

          You haven't looking very far. Open source is used in millions of products.

          I can't read code - it means absolutely nothing to me.

          So what? It's the whole market that matters, not just you.

          So this whole point on OSS being transparent and knowing what the software really does, doesn't apply to me.

          It applies to anybody in a functioning free market who wants third parties to ver

        • You can read code. You don't want to learn how. That's fine, but don't play the martyr card.

          It will almost always be more expensive to hire someone to build you something than it would be to buy something already built. The prepackaged solution has already been paid for, and the developer is hoping that enough people will want to buy in to make them a profit. This is a good model for problems multiple people have. It doesn't work very well for individual issues.

          A contractor doesn't care about how many peopl
    • This is a pointless article only if you assume that "anyone" is spending the same time and effort looking for flaws as the hackers, let alone fixing them.

      Are you that confident that such efforts are taking place?
  • OMG!!! (Score:2, Insightful)

    by Anonymous Coward
    Tools can be used for evil purposes! News at 11!
    • Re: (Score:2, Insightful)

      by Tsunayoshi (789351)
      In other news...

      Experts say that by selling cars, car dealers are giving criminals a means to escape from the scene of a crime.
      • Hold on one momemnt.... Experts now believe that by banks holding money that is the reason they are robbed
        • Re: (Score:2, Funny)

          by Bing Tsher E (943915)
          And since 'money' is a social construct created for 'the betterment of society,' if social theorists can come up with reasons why society would be better served if the money were 'freed from the grip of the money hoarders,' then we clearly need to back the bank robbers in their liberation struggle.
    • Re: (Score:2, Funny)

      by sd_diamond (839492)

      Tools can be used for evil purposes! News at 11!

      My tool is only used for good.

  • Not earth-shattering (Score:4, Informative)

    by adnonsense (826530) on Sunday October 08, 2006 @09:28AM (#16354437) Homepage Journal

    Someone [ihackstuff.com] has done pretty well out of the normal Google engine for this kind of "research".

  • by kafka47 (801886) on Sunday October 08, 2006 @09:30AM (#16354441) Homepage

    Slashdot readers beat 'em to it!

    The previous story /. precipitated comments [slashdot.org] that did exactly that.

  • Since it is easier for everybody to find bugs and vulnerabilities, it is now easier to fix them. Relying on the fact that your source code hides in some corner of a CVS repository where nobody really wants to casually go is just a lesser form of security by obfuscation. Would you rather have truly secure software or software that only seems to be secure?
  • by c0l0 (826165) on Sunday October 08, 2006 @09:37AM (#16354471) Homepage
    only to those whose "security" in reality consists of not much - or even nothing - more than obscurity.
    • by Xugumad (39311)
      Exactly. Personally, and I'm a software developer, I'm almost cheering the crackers on... and certainly, I think this is a brilliant example of the power of Google Code search to allow security problems to be easily located, and then fixed (well, if you're me, anyway).
    • only to those whose "security" in reality consists of not much - or even nothing - more than obscurity.

      ..which accounts for a whole lot of people.
    • Q: Why is beginning a comment in the Subject: line annoying?
      • by NemosomeN (670035)
        You just won Slashdot. Congrats.
        • by vadim_t (324782)
          Actual answer: Because unlike other sites (like kuro5hin) that require you to write something in the title, slashdot stupidly makes the default subject "Re:", so 99% of the subject lines on slashdot are useless and skipped by the readers.

          A quite possible side effect of this is higher database load. Unlike kuro5hin, slashdot's threaded mode is completely useless, as trees with 50 posts are rendered as 50 lines with the same title, not giving the slightest indication of whether there might be something worth
    • only to those whose "security" in reality consists of not much - or even nothing - more than obscurity.

      With only a small handful of very rare exceptions, all security is implemented through obscurity. Passwords, keys, certificates, codes; even biometrics authentication can often be circumvented with the right knowledge.

      The key to security is knowing what to use as your secret. A randomly-generated private key makes a better secret than an algorithm, especially when you publish an implementation of tha

  • by zecg (521666) on Sunday October 08, 2006 @09:41AM (#16354487)
    How is searching for something misuse of the search engine? I'd say that the Internet was misused by those who made the information public in the first place.
  • by Bromskloss (750445) <auxiliary.addres ... noSPAM.gmail.com> on Sunday October 08, 2006 @09:45AM (#16354505)
    If you accidentally put something publicly available on a web page, it can be found, manually or by a search engine. This is really no different from how it has always been with text, images and anything else that you can put on the web.
  • by The MAZZTer (911996) <megazzt AT gmail DOT com> on Sunday October 08, 2006 @09:47AM (#16354517) Homepage
    "Powered by phpBB" in order to find phpBB boards that were vulnerable to an exploit to hack. This isn't exactly a new technique. Well ok I know it's not exactly the same thing but the idea is still the same.
  • Absolute FUD (Score:4, Informative)

    by scdeimos (632778) on Sunday October 08, 2006 @09:47AM (#16354519)
    The article talks about how easy it is to use Google Codesearch and goes further to suggest that the regular search can't be used to find code.

    B.S.!

    I've used Google search to find all sorts of code snippets over the years, particularly #define's for constants that Microsoft don't actually define anywhere on MSDN.
    • by Khuffie (818093)
      Where does it say that the regular search can't be used to find code?

      From the article:

      Skilled hackers may already be able to do this type of search with Google's Web search engine, but Code Search is "another tool that makes it a tad easier for the attacker," says Johnny Long, a security researcher with Computer Sciences Corp, in an e-mail interview.
    • by waveclaw (43274)
      I've used Google search to find all sorts of code snippets over the years,

      Back in the day, being someone that 'asked the internet' for any non-trivial information was considered n00bish [computerjokes.net]. Now teh Intarweb is all-knowing and all-seeing[1].

      It's as if not code-specific search is new:

      These sites have been around a while (in Internet time) and specialize in source code search[2].

      A good 3/5s of my help for people in Linux starts with Google'ing on error messages, #defines, and nam

  • be misused to search for software bugs, password information and even proprietary code that shouldn't have been posted to the Internet, security experts said Friday.

    What else can one say, but DUH. If someone is stupid enough to leave their confidential files on a fucking web server, they won't be confidential for long. Google didn't create the problem. malicious hackers would probably have found them anyway, just now everyone else can.

  • 16: my $self = shift;
              # XXX a hole you could drive a fucking bus through
              my $method = $self->cgi->param('method') || 'hello';

    Yeah, I'm sure no malicious mind ever knew about grep and had to wait on Google.
  • evolution (Score:5, Insightful)

    by doti (966971) on Sunday October 08, 2006 @09:55AM (#16354555) Homepage
    I think previous posters got it wrong. They say the cracker access to the code is just as easy as anyone else's who can fix it. But a developer looks only for the code he's involved to, while the cracker is looking for any exploitable program. That, and although coders eventually search for security holes, he's goal is to build features. So, it indeed is making it easier for the crackers.

    Which is a good thing, if you realize bad environment also leads to evolution. More bugs exposed, the more developers will fix them, and maybe one day software designers will get it right, stop using insecure programming language, and write safer code.
    • Re:evolution (Score:5, Insightful)

      by Tim C (15259) on Sunday October 08, 2006 @11:40AM (#16355201)
      stop using insecure programming language

      No language offers 100% security. Some offer features that are easy to misuse in such a way as to inadvertently introduce security holes, but there is no such thing as a "secure" programming language; bad/inexperienced coders will produce dross whatever language they use.
  • This whole thing smells really badly. Meaning: we know our products suck, people know what we tell them, and it's good for us this way. If somebody makes them possible with some tools to find out anything about what we don't want to tell them, that's bad for us. Even if they could find out these things without using those tools, it's good for us they have those tools since now we have somebody to blame. Either way, we win.
     
  • by LaughingCoder (914424) on Sunday October 08, 2006 @10:08AM (#16354619)
    I know my way around code pretty well. While poring through some source code I discover a code snippet with a particular vulnerability that I can exploit. Now if only I had a way to see if this same snippet appeared in other applications. I guess I'll have to wait for Google to introduce a source code search mechanism before I can figure that out. Bummer.
  • by v1 (525388) on Sunday October 08, 2006 @10:20AM (#16354665) Homepage Journal
    People need to stop blaming those that provide tools and research for their finding or their ability to find bugs and errors. It's not their fault. If you screw up and someone finds it, it's not their fault, it's yours. Take responsibility and deal with the consequences.

    The people that make the problems usually cry that the entire world needs to tell them about their mistakes in a nice quiet, private way, so they can silently fix them and avoid any unnecessary damage. The reality of this, as we have seen time and time again, is that when they are informed of these problems, so often they go ignored for months and months. And then the issue is finally leaked and they cry you didn't give us enough time! No, it was your fault to begin with, it doesn't matter if someone else made your mistake worse, none of this would have hapened without you screwing it up to begin with. This is how the world encourages you to try harder to get it right the first time instead of tossing us crap and fixing it later.

    In summary, anyone that fights against auditing tools clearly has a quality control or security issue they are unwilling to fix and are afraid to have exposed.

    (The whole model of "sell crap, fix later" is broken from the get-go. That's why we have crappy software hustled to the store in "version 1.0.0" form and have to beg the authors for bug fixes for the next half year. Problem is they already have your money, and that upgrade is free, so why should they pour resources into a 1.1 when there's no more money to be made? It's a losing proposition if you don't intend to release a paid 2.0 later, or if you think you can sucker them a second time)
    • by Fordiman (689627)
      The primary difference between proprietary and open source code: Open source actually calls it 'beta'.
  • Locks on doors. (Score:3, Interesting)

    by kafka47 (801886) on Sunday October 08, 2006 @10:27AM (#16354695) Homepage

    A lot of people are skeptical about the security risks of this. The general claim is that if it's up on the web, a) it can be found anyhow, and b) you should know that it's secure (or insecure).

    True, however here is another way of looking at it.

    Lets say I buy a brand of lock for my house, which is later to be defective. Perhaps I don't know about this defect, or I don't have the time or expertise to fix it quickly.

    Then someone develops a technology that alerts burglars to which houses have that specific brand of lock.

    Wouldn't that be cause for some concern?

    I think code-searching for vulnerabilities is mildly concerning, even far beyond the usual methods that exist without code search. Note I said mildly. This isn't going to cause the catastrophic collapse of the Internet. It's just one more thing for people to be aware of and (hopefully) take action on.

    /K

    • This analogy breaks down, however, in that the owners of the house did not already specifically choose to post the details of their lock choice to a public forum and explicitally grant the right for everybody to read and redistribute it freely. Furthermore, this search engine does not index users of code, only the original code itself. So a better analogy would have been that which applies to the lock makers, not the home-owners who employ them.
  • What do you mean, "inadvertently"? :)
  • IDG Hatchet Job (Score:4, Informative)

    by Doc Ruby (173196) on Sunday October 08, 2006 @10:37AM (#16354775) Homepage Journal
    "The downside is that you could also use that kind of search to look for things that are vulnerable and then guess who might have used that code snippet and then just fire away at it," says Mike Armistead, vice president of products with source-code analysis provider Fortify Software.


    So Robert McMillan of IDG digs up a small competitor to Google Code, who says actually publishing open source is bad. Of course, the point of open source is that anyone, not just motivated attackers, can inspect the source to reveal problems, and even fix them ourselves.

    Fortify doesn't seem to offer GPL [google.com] or any other open source for its own product. But it does seem to publish its own version of Google Code's results [fortifysoftware.com]. Which any worthwhile reporter would have learned, if they wanted to tell us a story about the risks of open source, rather than a competitor's story of how "Google is Evil".
  • I call this FUD (Score:5, Insightful)

    by Opportunist (166417) on Sunday October 08, 2006 @10:52AM (#16354873)
    Today's "hacks" mostly go for widely spread software. Why? Simple. For maximum impact. There are, of course, still targetted attacks, but those targets tend to be machines and nets of high interest for the hackers. If you use insecure software there, you earned that hack well.

    So the key target is to get access to as many machines as possible, to create spambots, to phish for information, in other words, the key target for attacks is the machine of the common man.

    Now, which approach would be more fruitful? To find a neat exploit, find out which software contains it and then match it against the software usually used by Joe Average? Or to do it reverse, find out what Joe uses and find exploits in that software?

    I think the recent revelation of buffer overflows in MS-Office and the Javascript exploit in the IE answers that question.
  • Pure FUD (Score:2, Informative)

    Both Krugle [krugle.com] and Koders [koders.com] already offered open source search services. Google isn't offering anything new.
  • We're living in a world were obscurity will become more and more invalid method of cheating, securing, confusing, misrepresenting, lying, disinforming, profiting, whatever.

    'IT' just makes it easier to find what is already out there. I'd say good for Google, another good step to their goal of "indexing the world".
  • Koders and even Krugle guys precede Google's code search, but they are going to have a hard time attracting more developers' eyeballs - check this [alexa.com].
    Too bad one can't get Google code search on there, too, but you can imagine how far that graph curve would be.
  • I have a hammer. I can build a house with it. Or I can kill someone with it. Does that make the hammer bad? Should we restrict the availability of hammers? Should we start requiring FBI background checks at Walmart in order to purchase a hammer? If we make it illegal to own a hammer, only criminals will have hammers.

    Seriously, any "tool" is like this. You can do wonderful creative things with it. Or you can do nefarious evil with it. That doesn't make the availability of the tool wrong or undesirea
  • FUD city.
    From TFA: Code Search is "another tool that makes it a tad easier for the attacker,"

    Like gcc and perl. Gee, those pesky tools. What do you know, personal computers are another tool that makes it a tad easer for the attacker too.

    Obviously developers concerned with security should take note of any new and current tools available, but to create a tone like Google is providing a date rape drug for crackers is just raw fud propaganda.

  • Stupid title.. (Score:2, Informative)

    by lunadog (821751)
    It's designed to be of use to hackers! It's the crackers I would be worried about!
  • by jnf (846084) on Sunday October 08, 2006 @02:23PM (#16356261)
    When I first saw the link about google code, I was in the process of attempting to find software that used a certain function that is vulnerable in a popular scripting language. This was remarkably difficult using just 'regular' google, even though it really shouldn't have been. However, then google code came out and poof I used it to look for code using the vulnerable function, and I found a lot.
  • good (Score:3, Interesting)

    by oohshiny (998054) on Sunday October 08, 2006 @04:06PM (#16357061)
    Security experts say that the security implications of Google Code Search are noteworthy, if not earth-shattering.

    Yes, and they are good implications. If a company lets proprietary, bug-infested source code leak onto the web, then they should have to deal with the consequences.
  • by fluor2 (242824) on Sunday October 08, 2006 @05:33PM (#16357721)
    The only difference for google code search and normal code search is that you can search for special characters that one normally cannot in google standard search. but thousands of people have already used google for searching code by just trying to limit their search by using words like "int long public" etc so nothing is new here, except that we now can search using e.g. php $variables, wheras the $-sign is ignored unless you use google code search.
  • Hunting rifle used to kill man. Details at 7.

"Catch a wave and you're sitting on top of the world." - The Beach Boys

Working...