4 ms·

http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulner

by eganist 10y ago

http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... > This is the first major invocation of the policy in the three years since it was put in place http://venturebeat.com/2016/10/31/google-discloses-actively-exploited-windows-vulnerability-just-10-days-after-reporting-it-to-microsoft/ http://venturebeat.com/2016/10/31/google-discloses-actively-... > This is not the first time that Google has disclosed Windows vulnerabilities before a patch was ready. In fact, the company did this for Windows 8.1 twice in January 2015. Microsoft understandably wasn’t pleased, but this time around is even more serious. Both of those earlier vulnerabilities weren’t being actively exploited. [emphasis added] ••• A longstanding policy doesn't make it a good one.

iancarroll 10y ago
Both of those earlier incidents were after Microsoft passed the 90 day (3 months!) deadline.
- eganist 10y ago
  That makes this one even worse, if anything. The disclosure in question wasn't even two weeks in.
  - foota 10y ago
    It means the other two examples aren't relevant.
  - anfedorov 10y ago
    Worse? Did you miss the part where this vuln is being actively exploited? I'd much prefer if Google disclosed this sort of thing to trusted software vendors immediately and the public within 24-48 hours of finding out.
    - eganist 10y ago
      > Did you miss the part where this vuln is being actively exploited? Not at all. That's actually the crux of my argument that this is promotional. Google, Microsoft, and Facebook all collaboratively met at an event outside defcon this year called bountycraft. In it, they shared their practices handling vulnerability disclosure and other related events. All three have arguably the best secure development lifecycles in tech right now. All three are intimately aware of each other's practices. Microsoft is assuredly fixing this into overtime. Microsoft assuredly knew this was in use in the wild. They're already working beyond full speed, and Microsoft has a history of sharing mitigations with third party security vendors. Given the relationship I described above, Google certainly knows all of this and knows that Microsoft won't be able to act any faster to handle this. No one is served well by this disclosure except for two parties: · Unprivy malware authors (the vast majority) who are now actively researching this disclosure. · Google, by convincing users to use their browser for protection. This was a marketing play.
      - konklone 10y ago
        Or it's just P0 following their policy. Which is the only way P0 can maintain credibility and exert pressure on vendors to fix things. Especially after Google management just publicly overrode them regarding an Apple vulnerability a week or so ago.
        eganist 10y ago
        Sure. My earlier point: > A longstanding policy doesn't make it a good one. If this was a disclosure by the books, there would've been broader, less overtly promotional mitigations discussed. Project zero would be better off reformulating its disclosure policy here if credibility is what they're going for. Sometimes it's healthier to admit being wrong.
        konklone 10y ago
        While it might assuage some kneejerk skepticism like this, I don't think they're obligated to omit that Chrome has mitigations in place when disclosing a vulnerability.

by eganist 10y ago

iancarroll 10y ago

Both of those earlier incidents were after Microsoft passed the 90 day (3 months!) deadline.

eganist 10y ago
That makes this one even worse, if anything. The disclosure in question wasn't even two weeks in.
- foota 10y ago
  It means the other two examples aren't relevant.
- anfedorov 10y ago
  Worse? Did you miss the part where this vuln is being actively exploited? I'd much prefer if Google disclosed this sort of thing to trusted software vendors immediately and the public within 24-48 hours of finding out.
  - eganist 10y ago
    > Did you miss the part where this vuln is being actively exploited? Not at all. That's actually the crux of my argument that this is promotional. Google, Microsoft, and Facebook all collaboratively met at an event outside defcon this year called bountycraft. In it, they shared their practices handling vulnerability disclosure and other related events. All three have arguably the best secure development lifecycles in tech right now. All three are intimately aware of each other's practices. Microsoft is assuredly fixing this into overtime. Microsoft assuredly knew this was in use in the wild. They're already working beyond full speed, and Microsoft has a history of sharing mitigations with third party security vendors. Given the relationship I described above, Google certainly knows all of this and knows that Microsoft won't be able to act any faster to handle this. No one is served well by this disclosure except for two parties: · Unprivy malware authors (the vast majority) who are now actively researching this disclosure. · Google, by convincing users to use their browser for protection. This was a marketing play.
    - konklone 10y ago
      Or it's just P0 following their policy. Which is the only way P0 can maintain credibility and exert pressure on vendors to fix things. Especially after Google management just publicly overrode them regarding an Apple vulnerability a week or so ago.
      - eganist 10y ago
        Sure. My earlier point: > A longstanding policy doesn't make it a good one. If this was a disclosure by the books, there would've been broader, less overtly promotional mitigations discussed. Project zero would be better off reformulating its disclosure policy here if credibility is what they're going for. Sometimes it's healthier to admit being wrong.
        konklone 10y ago
        While it might assuage some kneejerk skepticism like this, I don't think they're obligated to omit that Chrome has mitigations in place when disclosing a vulnerability.