4 ms·

From VentureBeat: >Microsoft harshly criticized the disclosure. “Today’s disclosure by Google puts customers at potential risk,” a Microsoft spokesperson said.

From VentureBeat: >Microsoft harshly criticized the disclosure. “Today’s disclosure by Google puts customers at potential risk,” a Microsoft spokesperson said. “We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.” Really? Because I thought "your customers" were already at risk for an in the wild zero day exploit that's currently being used to infect Windows computers. How dare Google warn the public to allow them the time to take precautionary steps. I guess they think it's better for their customers to take it up the ass until they figure out how to patch it.

TallGuyShort 10y ago
Given Microsoft's well-known cadence for releases, it might be prudent for Google to update their policy to 2 weeks in some cases (e.g. not yet observed being actively exploited) so that something reported to Microsoft right before an update doesn't get disclosed right before they can reasonably release an update without moving heaven and earth. But if it's being actively exploited? Yes, thank you Google for letting us know ASAP. Would indeed be irresponsible not to in this case.
- Shank 10y ago
  The actively exploited window is 7 days, but the "normal" window is 90 days, which is far, far more than the Microsoft cadence. 7 days is plenty for a kernel level, actively exploited privilege escalation vulnerability, in my humble opinion.
- deleted 10y ago
  [deleted]
- alanh 10y ago
  There is precedent for Microsoft to release patches on days other than Tuesday (they call this “going out of band”) when an exploit is being used in the wild, especially if it is wormable. (This was the case for the hole that was later exploited by Conficker, for example.)
- anfedorov 10y ago
  Not moving heaven and earth, just fixing it in a week when you're notified that there's a critical vuln that's actively being exploited against your users. Yes, Google could lower the bar two two weeks, or three, or four, but IMO, even a week is way more than should be necessary: for actively exploited bugs of this magnitude, disclosure should really be 24-48 hours after notification, tops. Perhaps 24 hours to other vendors like Firefox / Opera, and 48 hours to public. This is not a "wait until the next release cadence" kind of issue, but more like a "scramble all jets and work through the weekend" kind. If I were a Windows user, I don't think there's anything else I'd want MS to work on over fixing an actively exploited remote priv escalation vuln. Google's security team worked through their Christmas vacations when they had an attack awhile back. To give other companies 7 days to patch their software is really quite generous.
  - dfox 10y ago
    Except this issue is _local_ privilege escalation that is mostly only relevant for defense-in-depth scenarios that involve sandboxing.
- shthed 10y ago
  They didn't have to provide a patch within 7 days, they just had to admit that it exists and tell their customers they're working on it.

TallGuyShort 10y ago

Given Microsoft's well-known cadence for releases, it might be prudent for Google to update their policy to 2 weeks in some cases (e.g. not yet observed being actively exploited) so that something reported to Microsoft right before an update doesn't get disclosed right before they can reasonably release an update without moving heaven and earth. But if it's being actively exploited? Yes, thank you Google for letting us know ASAP. Would indeed be irresponsible not to in this case.

Shank 10y ago
The actively exploited window is 7 days, but the "normal" window is 90 days, which is far, far more than the Microsoft cadence. 7 days is plenty for a kernel level, actively exploited privilege escalation vulnerability, in my humble opinion.
deleted 10y ago
[deleted]
alanh 10y ago
There is precedent for Microsoft to release patches on days other than Tuesday (they call this “going out of band”) when an exploit is being used in the wild, especially if it is wormable. (This was the case for the hole that was later exploited by Conficker, for example.)
anfedorov 10y ago
Not moving heaven and earth, just fixing it in a week when you're notified that there's a critical vuln that's actively being exploited against your users. Yes, Google could lower the bar two two weeks, or three, or four, but IMO, even a week is way more than should be necessary: for actively exploited bugs of this magnitude, disclosure should really be 24-48 hours after notification, tops. Perhaps 24 hours to other vendors like Firefox / Opera, and 48 hours to public. This is not a "wait until the next release cadence" kind of issue, but more like a "scramble all jets and work through the weekend" kind. If I were a Windows user, I don't think there's anything else I'd want MS to work on over fixing an actively exploited remote priv escalation vuln. Google's security team worked through their Christmas vacations when they had an attack awhile back. To give other companies 7 days to patch their software is really quite generous.
- dfox 10y ago
  Except this issue is _local_ privilege escalation that is mostly only relevant for defense-in-depth scenarios that involve sandboxing.
shthed 10y ago
They didn't have to provide a patch within 7 days, they just had to admit that it exists and tell their customers they're working on it.