• 13 Posts
  • 1.32K Comments
Joined 3 years ago
cake
Cake day: July 9th, 2023

help-circle





  • 2026’s Google I/O (Google’s annual developer conference) has been a disaster for the web. The conference-driven development’s forcing through of the Prompt API, a set of Modern Web Guidance skills for AI systems to use that are already showing major accessibility shortcomings, and a whole ton more AI-spangled sloppery, is rushed and unwelcome.

    I think the most damaging announcement is the changes coming to Google Search. Rather than a list of relevant links, a search on Google will be more aggressively prioritising the LLM-generated summary, now complete with vibecoded tables, graphs, and interactive elements.

    There has until now been a social contract. Website owners let Google scrape their sites and present them in Google Search, and, in exchange, Google Search sends traffic back to those sites. Google wins via adverts on the search page, and sites win due to however they monetise traffic. More largely, everyone wins because there is a financial incentive to create and produce new content.

    However, Google killing their side of the contract ends this. If Google only takes and never gives, then sites cannot profit. What is the incentive to publish if the only outcome is feeding Google’s AI with no return? What sources will LLMs have to pull from if all the sources are defunct? How far will Google go folding adverts into their AI output?

    I can see the huge short-term gain for Google, but I see no long-term path – not even an unsustainable one. This feels like the end, but of exactly what I’m uncertain.

    All of my peers (bar the ones that work at Google) are shattered in a way I’ve never seen before. I don’t know where we go from here.





  • How are you feeling about that now?

    I feel torn. Working here is not easy. From the outside, there’s massive negative sentiment, and there’s certainly something there. But the pain of working here is not very well understood. It’s this grand calculus of what it costs to live in the Bay Area and what personal sacrifices you are willing to make and what you’re willing to do for money. On the one hand, I feel massively privileged and lucky to work at a place like this. On the other hand, I’m like, where is my line?

    Christ.












  • Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.

    But wait

    Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.

    “Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,” Valadon wrote in an email. “I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career. It is obviously an individual’s mistake, but I believe that it might reveal internal practices.”

    One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers.

    This is shameful incompetence. Just head-rolling abysmal incompetence. These are the people they hired, for all you 1337 hax0rz currently looking.