5 ms·

Well done! That should be the rule, anything else is hypocritical.

by jdright 10y ago

Analemma_ 10y ago
No, "hypocritical" would be disclosing critical vulnerabilities in a competitor's product after a week of notification, when you yourself stop shipping security updates for your mobile operating system after two years; instead suggesting "buy a new phone!" as the solution. But no one would be that sleazy.
- bitmapbrother 10y ago
  Yes, it's far better to not inform the public that their computers are being infected by an active Windows zero day.
  - zelon88 10y ago
    I see where he's coming from though. It is hypocritical that Google cares so much about Microsoft's customers and then craps on their own user-base so regularly. Case in point: Google released the app launcher for Linux, waited for adoption to take place (so that devs and users had apps made, tested, installed, and in-use) and then they canned the whole thing because it was taking market share away from Chromium. Then, they canned Chromium OS! If I were Microsoft I'd tell them to mind their own damn business as well. It's obvious anyway that the only thing Google cares about in this instance is making themselves look good at the expense of Microsoft.
    - JoshTriplett 10y ago
      > Then, they canned Chromium OS! Chromium OS is alive and well. Perhaps you're thinking of the Chrome-specific "application" APIs, which have been deprecated in favor of web technologies?
    - bitmapbrother 10y ago
      Why shouldn't Google care about customers that use Windows? A large percentage of them also use Google services so it's in their interest to inform them. >If I were Microsoft I'd tell them to mind their own damn business as well. What would you tell their customers that were infected by their negligence? Let me guess? "Mind your own damn business".
      - zelon88 10y ago
        I'm sure Microsoft has a bug-bounty. Google looks for bugs in competitors software and then blackmails the developers with disclosure, irregardless of that bug bounty. That isn't white-hat at all.
        Buge 10y ago
        Bug bounties are usually for unexploited vulnerabilities that you find yourself. It sounds to me like google didn't discover this vulnerability on their own, they discovered malware that was exploiting it. I'm not sure if a bug bounty would pay out for a vulnerability you didn't discover.
        flattone 10y ago
        Some comments feel almost troll
    - golfer 10y ago
      Maybe after the ridiculous Scroogled campaign that Microsoft did against Google, and stealing Google's search results, and extorting money from Android OEMs for lame patents, Google has earned the right to bully Microsoft a little. I'm okay with this.
    - Ph0X 10y ago
      No, they did what any security researcher would do, Google or not. To be honest, their call is a perfect one. On the one hand, you don't tell anyone other than Microsoft and wait for them to patch as many people as possible while the bug is ACTIVELY being exploited and possibly thousands are getting hacked by the hour. On the other hand, you tell people, and many are now able to patch it themselves RIGHT NOW, force an update on their machine, not use affected software, and potentially avoid a hack that would've happened if they didn't know. So yes, it's not black and white, but I think their call of waiting a week was an okay one.
- magicalist 10y ago
  Not only is that not hypocritical (I would try actually looking up the definition, for one), it would also be monumentally stupid for security researchers to wait until all products at their employer are fixed before disclosing outside vulnerabilities.
  - kobayashi 10y ago
    Agreed. Though Analemma_ has a point about Google's decision not to provide security updates to Android devices/OSs which are just 2 years old.
- Buge 10y ago
  It's 3 years of security updates for Pixel and Nexus phones.
  - Ph0X 10y ago
    And that's a minimum guaranty. We have yet to see if they truly stop or keep going.
    - kuschku 10y ago
      No? We've seen Nexus devices being dropped after only 16 months of support.
      - guelo 10y ago
        I don't believe that's true. The shortest update life span was the 2011 Galaxy Nexus for 20 months. Ever since then the models have been updated for 3 years or more.
        kuschku 10y ago
        No? They got 2.5 years of security updates after release (and not 2 years of security updates after sale, as EU law demands), and they certainly only get 18 months of feature updates after release. The Nexus 5 was already dropped in October 2015, having been released in October 2013. Same with the Nexus 6 (it was dropped yesterday, being 2 years old). It’s always been 18-24 months of updates max, and only if you buy on release day. https://support.google.com/nexus/answer/4457705#nexus_devices https://support.google.com/nexus/answer/4457705#nexus_device...
        dmix 10y ago
        That page you linked to says otherwise > Nexus devices get security patches for at least 3 years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer. Google is still releasing security patches for Nexus 5 http://www.androidpolice.com/2016/08/01/august-security-patches-rolling-august-1st-august-5th-levels/ http://www.androidpolice.com/2016/08/01/august-security-patc... The most recent one for Nexus 5 aka Hammerhead was this month: M4B30X, Oct 2016 https://developers.google.com/android/images https://developers.google.com/android/images You're mistaking the major version releases (6.x.x vs 7 x.x) with security patches, they are not promising major updates here only security patches for 6.x.x.
- simula67 10y ago
  I can't tell if the Windows versions affected are still supported. It would be only hypocritical if Google has refused to patch a vulnerability in their supported OS before 7 days after it was privately disclosed with them. Android support term being too small is another problem.

Well done! That should be the rule, anything else is hypocritical.

by jdright 10y ago

Well done! That should be the rule, anything else is hypocritical.

No, "hypocritical" would be disclosing critical vulnerabilities in a competitor's product after a week of notification, when you yourself stop shipping security updates for your mobile operating system after two years; instead suggesting "buy a new phone!" as the solution. But no one would be that sleazy.

bitmapbrother 10y ago
Yes, it's far better to not inform the public that their computers are being infected by an active Windows zero day.
- zelon88 10y ago
  I see where he's coming from though. It is hypocritical that Google cares so much about Microsoft's customers and then craps on their own user-base so regularly. Case in point: Google released the app launcher for Linux, waited for adoption to take place (so that devs and users had apps made, tested, installed, and in-use) and then they canned the whole thing because it was taking market share away from Chromium. Then, they canned Chromium OS! If I were Microsoft I'd tell them to mind their own damn business as well. It's obvious anyway that the only thing Google cares about in this instance is making themselves look good at the expense of Microsoft.
  - JoshTriplett 10y ago
    > Then, they canned Chromium OS! Chromium OS is alive and well. Perhaps you're thinking of the Chrome-specific "application" APIs, which have been deprecated in favor of web technologies?
  - bitmapbrother 10y ago
    Why shouldn't Google care about customers that use Windows? A large percentage of them also use Google services so it's in their interest to inform them. >If I were Microsoft I'd tell them to mind their own damn business as well. What would you tell their customers that were infected by their negligence? Let me guess? "Mind your own damn business".
    - zelon88 10y ago
      I'm sure Microsoft has a bug-bounty. Google looks for bugs in competitors software and then blackmails the developers with disclosure, irregardless of that bug bounty. That isn't white-hat at all.
      - Buge 10y ago
        Bug bounties are usually for unexploited vulnerabilities that you find yourself. It sounds to me like google didn't discover this vulnerability on their own, they discovered malware that was exploiting it. I'm not sure if a bug bounty would pay out for a vulnerability you didn't discover.
        flattone 10y ago
        Some comments feel almost troll
  - golfer 10y ago
    Maybe after the ridiculous Scroogled campaign that Microsoft did against Google, and stealing Google's search results, and extorting money from Android OEMs for lame patents, Google has earned the right to bully Microsoft a little. I'm okay with this.
  - Ph0X 10y ago
    No, they did what any security researcher would do, Google or not. To be honest, their call is a perfect one. On the one hand, you don't tell anyone other than Microsoft and wait for them to patch as many people as possible while the bug is ACTIVELY being exploited and possibly thousands are getting hacked by the hour. On the other hand, you tell people, and many are now able to patch it themselves RIGHT NOW, force an update on their machine, not use affected software, and potentially avoid a hack that would've happened if they didn't know. So yes, it's not black and white, but I think their call of waiting a week was an okay one.
magicalist 10y ago
Not only is that not hypocritical (I would try actually looking up the definition, for one), it would also be monumentally stupid for security researchers to wait until all products at their employer are fixed before disclosing outside vulnerabilities.
- kobayashi 10y ago
  Agreed. Though Analemma_ has a point about Google's decision not to provide security updates to Android devices/OSs which are just 2 years old.
Buge 10y ago
It's 3 years of security updates for Pixel and Nexus phones.
- Ph0X 10y ago
  And that's a minimum guaranty. We have yet to see if they truly stop or keep going.
  - kuschku 10y ago
    No? We've seen Nexus devices being dropped after only 16 months of support.
    - guelo 10y ago
      I don't believe that's true. The shortest update life span was the 2011 Galaxy Nexus for 20 months. Ever since then the models have been updated for 3 years or more.
      - kuschku 10y ago
        No? They got 2.5 years of security updates after release (and not 2 years of security updates after sale, as EU law demands), and they certainly only get 18 months of feature updates after release. The Nexus 5 was already dropped in October 2015, having been released in October 2013. Same with the Nexus 6 (it was dropped yesterday, being 2 years old). It’s always been 18-24 months of updates max, and only if you buy on release day. https://support.google.com/nexus/answer/4457705#nexus_devices https://support.google.com/nexus/answer/4457705#nexus_device...
        dmix 10y ago
        That page you linked to says otherwise > Nexus devices get security patches for at least 3 years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer. Google is still releasing security patches for Nexus 5 http://www.androidpolice.com/2016/08/01/august-security-patches-rolling-august-1st-august-5th-levels/ http://www.androidpolice.com/2016/08/01/august-security-patc... The most recent one for Nexus 5 aka Hammerhead was this month: M4B30X, Oct 2016 https://developers.google.com/android/images https://developers.google.com/android/images You're mistaking the major version releases (6.x.x vs 7 x.x) with security patches, they are not promising major updates here only security patches for 6.x.x.
simula67 10y ago
I can't tell if the Windows versions affected are still supported. It would be only hypocritical if Google has refused to patch a vulnerability in their supported OS before 7 days after it was privately disclosed with them. Android support term being too small is another problem.