6 ms·

It's also interesting that the exploit was found by a Google employee who was designated #1 in the top 15 Most Influential People in Security. http://www.eweek.

It's also interesting that the exploit was found by a Google employee who was designated #1 in the top 15 Most Influential People in Security. http://www.eweek.com/c/a/Security/The-15-Most-Influential-People-in-Security-Today/1/ http://www.eweek.com/c/a/Security/The-15-Most-Influential-Pe... With the resources both Google and Microsoft have at their disposal, I wonder if it's worth having a few employees discovering security flaws in your opponent's platform.

pbhjpbhj 17y ago
Knowing about opponents security flaws is an awesomely powerful publicity/propaganda tool. MS release something on how IE8 is just as secure as Chrome (browser) and Google counter-release how it's got a hole the size of the Great Rift that's been inherited right back from IE6...
- tptacek 17y ago
  No, I really doubt Google would do that. For one thing, it's not done. For another, Google would lose that fight, badly; they are severely outgunned on this front.
  - pbhjpbhj 17y ago
    Why is it not done to call out opponents when they make huge claims that are patently not true? Haven't Mac used this in their "I'm a Mac" advertising campaign (albeit hiding behind "PC" rather than saying "Windows PC"). Google would lose because they make big claims about security and their opponents know about lots of security flaws??
    - tptacek 17y ago
      What's not done is for software vendors to drag out specific vulnerabilities --- I would say "particularly vulnerabilities they themselves uncovered", but that's never happened --- and use them to market competing software. Why? Because Google and Microsoft have a lot more to fear from 4 person companies spending 90% of their time researching vulnerabilities than they do from each other, and waving flaws around as if they were some kind of point score concedes a huge marketing point. Google would lose because Microsoft outspends Google significantly on vulnerability research. This particular arms race is never going to happen, but if it did, Microsoft would win it.
      - rbanffy 17y ago
        "but if it did, Microsoft would win it." There is a difference. It's much easier to upgrade Google's applications than Microsoft's. When Google patches Gmail, it takes a couple minutes for me to enjoy my corrected version. When Microsoft issues a correction, it could take weeks until it hits the Windows Update servers and that could easily turn into months before many businesses incorporate it into their update sets. It's not only the size of the attack surface, but the time it remains open. There is also a huge factor in public perception - people perceive their computers as imperfect mostly because they are astonishingly unreliable. If Google can make people happier with their computers and web applications than they are with Windows and desktop apps, Microsoft will have a huge problem that may not be solvable by throwing money and people at it.
        tptacek 17y ago
        What does any of this have to do with the discussion? Google is not going to start using individual security findings as marketing collateral.
        rbanffy 17y ago
        but if it did, the outcome would not be as certain as you stated.
        tptacek 17y ago
        You sound awfully sure of yourself. You must know a lot of things about product security that I don't. Would love to hear them sometime.
        rbanffy 17y ago
        It's not about security. It's about perception. If something makes people more comfortable with web applications than with desktop applications (and a "Windows is inherently insecure and broken" perception would do a lot for that) Microsoft will have a problem they probably will not be able to deal with in time. Remember Google has deep pockets and less legacy to protect. They can move fast. Microsoft has a very complicated entanglement of obligations and expectations they will have a hard time compromising. The perception of a rule-changing development is incredibly dangerous for them, and giving mixed messages about which way their corporate clients should go with their IT infrastructure won't help either. Why do you think Microsoft would end up in advantage after such a confrontation?
btilly 17y ago
I would guess the value proposition is more a case of worrying about ...security flaws in software used on your network rather than ...security flaws in your opponent's platform.
tptacek 17y ago
I'm pretty sure Google didn't sic Tavis on Microsoft; this is a logical extension of work he's been doing for years.
jsz0 17y ago
For a company like Google it would probably be worth doing just to make sure all those Windows PCs stay online and continue to access Google services/advertisements. Imagine a truly malicious exploit that knocked 10-15% of Windows computers offline instead of joining them to a bot net. Even if only half of those computers were previously accessing Google services they would see a big hit in advertising revenue.

pbhjpbhj 17y ago

Knowing about opponents security flaws is an awesomely powerful publicity/propaganda tool. MS release something on how IE8 is just as secure as Chrome (browser) and Google counter-release how it's got a hole the size of the Great Rift that's been inherited right back from IE6...

tptacek 17y ago
No, I really doubt Google would do that. For one thing, it's not done. For another, Google would lose that fight, badly; they are severely outgunned on this front.
- pbhjpbhj 17y ago
  Why is it not done to call out opponents when they make huge claims that are patently not true? Haven't Mac used this in their "I'm a Mac" advertising campaign (albeit hiding behind "PC" rather than saying "Windows PC"). Google would lose because they make big claims about security and their opponents know about lots of security flaws??
  - tptacek 17y ago
    What's not done is for software vendors to drag out specific vulnerabilities --- I would say "particularly vulnerabilities they themselves uncovered", but that's never happened --- and use them to market competing software. Why? Because Google and Microsoft have a lot more to fear from 4 person companies spending 90% of their time researching vulnerabilities than they do from each other, and waving flaws around as if they were some kind of point score concedes a huge marketing point. Google would lose because Microsoft outspends Google significantly on vulnerability research. This particular arms race is never going to happen, but if it did, Microsoft would win it.
    - rbanffy 17y ago
      "but if it did, Microsoft would win it." There is a difference. It's much easier to upgrade Google's applications than Microsoft's. When Google patches Gmail, it takes a couple minutes for me to enjoy my corrected version. When Microsoft issues a correction, it could take weeks until it hits the Windows Update servers and that could easily turn into months before many businesses incorporate it into their update sets. It's not only the size of the attack surface, but the time it remains open. There is also a huge factor in public perception - people perceive their computers as imperfect mostly because they are astonishingly unreliable. If Google can make people happier with their computers and web applications than they are with Windows and desktop apps, Microsoft will have a huge problem that may not be solvable by throwing money and people at it.
      - tptacek 17y ago
        What does any of this have to do with the discussion? Google is not going to start using individual security findings as marketing collateral.
        rbanffy 17y ago
        but if it did, the outcome would not be as certain as you stated.
        tptacek 17y ago
        You sound awfully sure of yourself. You must know a lot of things about product security that I don't. Would love to hear them sometime.
        rbanffy 17y ago
        It's not about security. It's about perception. If something makes people more comfortable with web applications than with desktop applications (and a "Windows is inherently insecure and broken" perception would do a lot for that) Microsoft will have a problem they probably will not be able to deal with in time. Remember Google has deep pockets and less legacy to protect. They can move fast. Microsoft has a very complicated entanglement of obligations and expectations they will have a hard time compromising. The perception of a rule-changing development is incredibly dangerous for them, and giving mixed messages about which way their corporate clients should go with their IT infrastructure won't help either. Why do you think Microsoft would end up in advantage after such a confrontation?

btilly 17y ago

I would guess the value proposition is more a case of worrying about ...security flaws in software used on your network rather than ...security flaws in your opponent's platform.

tptacek 17y ago

I'm pretty sure Google didn't sic Tavis on Microsoft; this is a logical extension of work he's been doing for years.

jsz0 17y ago

For a company like Google it would probably be worth doing just to make sure all those Windows PCs stay online and continue to access Google services/advertisements. Imagine a truly malicious exploit that knocked 10-15% of Windows computers offline instead of joining them to a bot net. Even if only half of those computers were previously accessing Google services they would see a big hit in advertising revenue.