nitrammm
Joined 3 years ago
Joined 3 years ago
Got to love the cleverness with the people who design services with the assumption that there are no such people and then goes on to hackernews and cries when a kid in China breaks their site. Lol.
Insanely incompetent.
That's pretty crazy viewpoint.
If you lie in your marketing material then you may put yourself in a mess. Big surprise.
Personally I would never rely on a service like this since it's 100% obvious it would be sudpectible to junior developers misunderstanding what is reasonable usage.
If you're putting up an API assuming all consumers will consume it in some limited and reasonable way, then you need to rethink things a bit.
> Supports unlimited requests and is free.
Typically "unlimited" is more than a million.
> we identified a gap in GCP’s security layer that was created for SQL Server. This vulnerability enabled us to escalate our initial privilege and add our user to the DbRootRole role, a GCP admin role.
So Google took proprietary software not designed for this use-case and built their own security layer on top of it and ended up with bugs.
Of course that's an issue with the service. Presenting it as anything else than an issue in Cloud SQL seems disingenuous.
Saying that someone is an asshole for using an API in a way which clearly should be possible according to the documentation is a very clear sign of that person being a junior developer who don't have actual real world experience of anything except toy projects. Any developer with some years of experience would understand that this would happen and he should not be surprised over it.
It's very possible that no one involved in this is even aware of this issue, so automatically calling them assholes is somewhat incompetent at best.