Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.
JavaScript can access any page and cookie from the same domain. So if I visited your googledrive.com hosted site, JavaScript from your site could potentially retrieve and send to you any other content on googledrive.com to which I have access.
The only harm that I think can happen with JS is you being able to access/set any cookies/storage that are set by another 'public' site hosted on Google Drive that you've accessed earlier.
That's PER link, so you can drop it in another folder, change the link, and maybe it refreshes since it's a different link? Can someone from Dropbox confirm this?
Yes, it uses googledrive.com, but not for anything user-identifiable.
The threat is that a user logs in to googledrive.com and receives an authentication cookie tied to their Google account. Later, they view a malicious user page at googledrive.com/host/someevilpage, and a script on that page reads the authentication cookie and sends it to the attacker, who can now log in to googledrive.com as the victim.
That doesn't happen here because you don't actually log in to googledrive.com. The worst a malicious script could do is harvest data set by other scripts, and that's a drastically smaller (although still present) threat.
I think this might be a pretty nice tool for people learning how to program for the web, in that it's easy to share a link with friends for some quick feedback.
I've been waiting for this for a while. Although git is my preferred method of working, for people who aren't technical and who just can't do stuff from terminal, I think this is a great alternative.
I've been waiting for this for a while. Although git is my preferred method of working, for people who aren't technical and who just can't do stuff from terminal, I think this is a great alternative.
Is that an official Google page on how to do this, or a demo you put together that Google may nix shortly? I ask mainly because a DS_Store file is visible in the directory, which strikes me as not a typical Google thing. Do they even use Mac OS for anything?
#whois googledrive.com
Registrant:
Matt Serlin
DNStination Inc.
303 Second Street Suite 800 North
San Francisco CA 94107
US
admin@dnstinations.com +1.4155319335 Fax: +1.4155319336
Nifty. Note, however, that if you want to use it to share javascript demos or something, and you're on a google apps domain that forces https, you might hit something similar to "[blocked] The page at https://googledrive.com/whatever ran insecure content from http://code.jquery.com/jquery-1.9.1.min.js. So you'll have to include your own copy of jQuery or Require or whatever.
Syncdocs http://syncdocs.com lets you publish a website to Google Drive right from your desktop. It also gives a much shorter goo.gl URL, and automatically re-publishes changes.
However, Google Drive might has usage restrictions, so this is probably only for low traffic sites.
That's a bit of a whiny comment! Use something else if you don't like the Urls. Urls are less relevant these days anyway. Who types Urls anymore? Or who even looks at them?
Google is no charity, sure. But they make it easy for people to develop web apps, prototype and monkey with web content, they allow people to share their work with a simple click, but GOD the URLs are not good enough for some random dude on the Internets, we'd better throw our arms in the air and get all snarky about it.
With this trend of negativity I guess we've found the cure for mortality. It gets REALLY old but somehow never dies.
Who types URLs or looks at them? If you write URLs in an email, print them on a business card, put them on a poster, say them in a conversation, or basically need anybody who isn't already using a web browser to go to your page, you type URLs and look at them (or hear them). Hearing is the worst offender.
- Hey there, you should check out this really cool site/post/app/thing!
- That sounds nice, where should I go?
- You go to uh.. googledrive dot com slash host slash zero capital B ehh... forget it.
There is a reason that facebook gave their users vanity URLs, and twitter user URLs are so minimalist, and people pay millions for domain names. A shorter URL is more useful and hence more valuable.
Having the option to point your own domain at the folder would be really nice, actually, and put this on the same tier as Github Pages and S3.
You would never put a link like this on a business card or relay it in person anyway. You'd probably just hyperlink some text on a blog or in an email. It's pretty clear that this isn't a permanent web hosting solution.
Is the URL of that document pretty reliable or is it not really meant for the long term? I'm thinking of whether there would be issues with using a custom domain for it.
I currently host a static website from S3, and I still have to pay a couple of bucks for the traffic. Sounds like this would be completely free.
Check out GitHub Pages for hosting static content for free. I use it for all my statically-generated sites now, and it's been great other than the couple times GitHub went down.
Well, sometimes arrogance and being small minded does blind you to certain things.
Like how if you're an office manager and you finally got used to using Docs for word processing and spreadsheets but now wanted to make a webpage to send out a message about the office party, this would be a good option.
Or if you're the outreach coordinator at your local church group and having been using Gmail all the time to chat and setup group communication for awhile this would be really easy for you to get started at making a webpage to talk about the recent retreat.
Or if you're a high school student and you wanted to let people in your neighborhood know that you're a go-getter that's capable of walking their dogs, this would be a good option to make a webpage out of.
This is more for those that switched over from Microsoft Office world and it's more of a direct competitor to grab use cases for Apple/iWeb.
This does not appear to be an official Google site or suggestion. Personally, I'd use them for my cat's blog and that's about it. Google could pull the plug on this at anytime
Right up until the underlying platform decides it needs a different model to support its business needs.
It really seems like there should be a middle ground: my ideas get published while ensuring your business survives. Right now, the two are independent functions.
68 comments
[ 5.3 ms ] story [ 135 ms ] threadI'm sure Google is not using http://googledrive.com/ for anything that's user-identifiable.
The only harm that I think can happen with JS is you being able to access/set any cookies/storage that are set by another 'public' site hosted on Google Drive that you've accessed earlier.
Looks like 20GB (free) or 200GB (paid) per day.
If you need more bandwidth, you would probably be looking at any of the other innumerable hosting solutions available on the web.
Look at the screenshot in the article. It is in fact using https://googledrive.com/
The threat is that a user logs in to googledrive.com and receives an authentication cookie tied to their Google account. Later, they view a malicious user page at googledrive.com/host/someevilpage, and a script on that page reads the authentication cookie and sends it to the attacker, who can now log in to googledrive.com as the victim.
That doesn't happen here because you don't actually log in to googledrive.com. The worst a malicious script could do is harvest data set by other scripts, and that's a drastically smaller (although still present) threat.
[1] - http://googleappsdeveloper.blogspot.com/2012/11/announcing-g...
[2] - https://developers.google.com/drive/publish-site
(the url in the image at the bottom is the url of the page itself)
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.0/jquery.min.js"></script>
The CDN also hosts a few of other popular libraries too : https://developers.google.com/speed/libraries/devguide
However, Google Drive might has usage restrictions, so this is probably only for low traffic sites.
Google is no charity, sure. But they make it easy for people to develop web apps, prototype and monkey with web content, they allow people to share their work with a simple click, but GOD the URLs are not good enough for some random dude on the Internets, we'd better throw our arms in the air and get all snarky about it.
With this trend of negativity I guess we've found the cure for mortality. It gets REALLY old but somehow never dies.
- Hey there, you should check out this really cool site/post/app/thing!
- That sounds nice, where should I go?
- You go to uh.. googledrive dot com slash host slash zero capital B ehh... forget it.
There is a reason that facebook gave their users vanity URLs, and twitter user URLs are so minimalist, and people pay millions for domain names. A shorter URL is more useful and hence more valuable.
Having the option to point your own domain at the folder would be really nice, actually, and put this on the same tier as Github Pages and S3.
Now you could see a very unreadable url in browser's address bar. If you share the url without shorten it, it's looks ugly.
I currently host a static website from S3, and I still have to pay a couple of bucks for the traffic. Sounds like this would be completely free.
Hosts more than css, html, js (for output)
Custom domains
Collaboration via revision control.
I see zero reason to ever use this when there are so many betters tools out there .
Like how if you're an office manager and you finally got used to using Docs for word processing and spreadsheets but now wanted to make a webpage to send out a message about the office party, this would be a good option.
Or if you're the outreach coordinator at your local church group and having been using Gmail all the time to chat and setup group communication for awhile this would be really easy for you to get started at making a webpage to talk about the recent retreat.
Or if you're a high school student and you wanted to let people in your neighborhood know that you're a go-getter that's capable of walking their dogs, this would be a good option to make a webpage out of.
This is more for those that switched over from Microsoft Office world and it's more of a direct competitor to grab use cases for Apple/iWeb.
[1] https://developers.google.com/drive/publish-site
[2] https://developers.google.com/storage/docs/website-configura...
and the associated drive SDK for publishing web content https://developers.google.com/drive/publish-site
In that if its unpopular or not to Google's expectation, they'll kill it all of a sudden.
I had tried to upload my website template that I was working on that used head.js (lazyloads javascript) and it was not working correctly.
>6/10
I recently started using Github as my blogging plaform. I just created a repo called 'thoughts' which has a bunch of markdown files inside.
When I create a new 'post' I just share the link to the markdown file on twitter/g+.
I can imagine someone using this feature in a similar way. A super lightweight, quick, and easy way to share some content.
Sometimes just getting the content out is far more important than having a nice website or url.
It really seems like there should be a middle ground: my ideas get published while ensuring your business survives. Right now, the two are independent functions.