Yeah, and WordPress is not outside the mainstream in their views on security either but they're wrong (which is constantly proven by how often WordPress sites get compromised.)
Part of my comment was directed at the fact that the mainstream standards of security for web developers (speaking as one myself) are too low.
Also: WordPress is far outside the mainstream of security practice; they are, and have been for coming up on a full decade, a running joke in the field.
This is a bit off-topic, but can you expand on this with regard to WordPress, or possibly link to someone who has? I work with WordPress and would be eager to learn more about where & how it's deficient, and how to guard against those deficiencies better.
WordPress is the mainstream of web development. It's not a non-sequitur because you brought up "the mainstream".
If you're saying that you meant the mainstream of security professionals specifically, I'd be interested in what a survey of security professionals had to say about open redirect. For me it's clearly a potential attack vector, and Google's specific implementation is obviously sloppy and lazy. I can't see any security professional worth their salt giving it a pass.
As far as Google not being a running joke, that's true and it's all the more reason it's surprising they are so dismissive of concerns about their way too broad whitelist.
I feel like at this point we both understand the point I was making and don't need to litigate it further. You can and should feel free to disagree with it, but there's a reason pentesters file open redirects sev:lo.
(XSS is the canonical sev:medium, for what it's worth).
Man if you are afraid to disagree with someone just because of who they are I feel bad for you. I've let pg have it on here when I disagreed with him. It doesn't matter. Everybody's wrong sometimes.
Part of my comment was directed at the fact that the mainstream standards of security for web developers (speaking as one myself) are too low.