3 ms·

What's the incentive for Google in doing this?

wolf550e 11y ago
Maybe Google could only hire people of this caliber if they let them spend some of their time doing work they will be able to talk about, besides the work on securing Google's internals which must remain secret.
mey 11y ago
http://googleprojectzero.blogspot.com/2014/07/announcing-project-zero.html http://googleprojectzero.blogspot.com/2014/07/announcing-pro... Google's goals are so grand they see things like securing software and getting faster broadband everywhere as things worth doing. I've been reading their blog since launch and the team is very skilled, professional and interested in proving theory with actual exploits.
wmt 11y ago
They fight back exploit peddlers like Zerodium or criminals who sell their findings to the highest bidder. You know, PR. They're basically do a huge service to their users and software companies by allowing the best exploit finders to focus on some software and then responsibly disclose their findings to the vendors, free of charge. http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zero.html http://googleonlinesecurity.blogspot.de/2014/07/announcing-p... The headline is kinda silly in the sense that if Project Zero focuses on any software in the world, they'll most likely find exploitable vulnerabilities. With Kaspersky the ridiculous thing is that they have stuff compiled without /GS, which e.g. since VS2005 has required you to actively disable it, as it's on by default.
- fixermark 11y ago
  It's slightly more than PR... Google sees the trustworthiness of people's interactions online as an existential necessity for the company. Things like tradeable zero-day exploits are a risk to the entire business model of having people search for things and conduct business on the Internet.
username223 11y ago
It seems like a pretty straightforward grey hat operation to me. Google pays crackers to find competitors' vulns, publishes them to give said competitors bad PR, and maybe even gets a bit of good PR for itself for "internet security" mumbo-jumbo.

Maybe Google could only hire people of this caliber if they let them spend some of their time doing work they will be able to talk about, besides the work on securing Google's internals which must remain secret.

mey 11y ago

http://googleprojectzero.blogspot.com/2014/07/announcing-project-zero.html http://googleprojectzero.blogspot.com/2014/07/announcing-pro... Google's goals are so grand they see things like securing software and getting faster broadband everywhere as things worth doing. I've been reading their blog since launch and the team is very skilled, professional and interested in proving theory with actual exploits.

wmt 11y ago

They fight back exploit peddlers like Zerodium or criminals who sell their findings to the highest bidder. You know, PR. They're basically do a huge service to their users and software companies by allowing the best exploit finders to focus on some software and then responsibly disclose their findings to the vendors, free of charge. http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zero.html http://googleonlinesecurity.blogspot.de/2014/07/announcing-p... The headline is kinda silly in the sense that if Project Zero focuses on any software in the world, they'll most likely find exploitable vulnerabilities. With Kaspersky the ridiculous thing is that they have stuff compiled without /GS, which e.g. since VS2005 has required you to actively disable it, as it's on by default.

fixermark 11y ago
It's slightly more than PR... Google sees the trustworthiness of people's interactions online as an existential necessity for the company. Things like tradeable zero-day exploits are a risk to the entire business model of having people search for things and conduct business on the Internet.

username223 11y ago

It seems like a pretty straightforward grey hat operation to me. Google pays crackers to find competitors' vulns, publishes them to give said competitors bad PR, and maybe even gets a bit of good PR for itself for "internet security" mumbo-jumbo.