4 ms·

> If anything, this just makes it worse Makes what worse? There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is F

> If anything, this just makes it worse Makes what worse? There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) and the plain implication is that Chrome on Windows 7 is indeed SOL.

deleted 10y ago
[deleted]
eganist 10y ago
> There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) If this wasn't an ad and was merely a security disclosure, I'd have expected appropriate research into which configurations mitigate the risk, not just a single configuration which happens to favor the browser maker. Add on top of that the trivialization of "Windows 10" as the noun in a second-order preposition of place as well as the reference to Chrome as the primary subject of the sentence, and even basic analysis of the sentence in question shows a bias.
- holtalanm 10y ago
  The disclosure came from Google. Of course there's a bias if they spent time coming up with a mitigation within their software. They aren't responsible for other browsers, so why would they research fixes within those browsers? That assumption is just plain idiotic. They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome.
  - eganist 10y ago
    > They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome. Then they should've waited until an official fix was out. They know one's being actively worked on. They know the primary exploit path (via Flash) was patched. To my earlier point: they should've just waited. > That assumption is just plain idiotic. That's not necessary. You might not see my face, but I'm still a person deserving of some amount of respect.
    - tptacek 10y ago
      Exactly what is the benefit of them waiting until an official fix is released if they have evidence of actual exploitation? How is anyone better off not knowing the details of a vulnerability that people are exploiting already? I'm having trouble making sense of your arguments on this thread, and I really am trying.
      - eganist 10y ago
        > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? This question is strange. On the one hand, the disclosure scares users into switching to Chrome even though Microsoft asserts Edge offers protection. On the other hand, the disclosure actually does not disclose the details of a vulnerability that people are exploiting already. Would you rather have had the disclosure include the exact vulnerability? I've addressed your other questions surrounding the benefits and drawbacks in other threads. No point in re-hashing them.
        tptacek 10y ago
        No, you can't move the goalposts like this. You just said Google should have waited to disclose until a complete fix was published. In asserting that, you must also assert you'd rather have Google disclose nothing than something.
        eganist 10y ago
        I would rather Google disclose nothing to the public until there's a fix, or at least until a far-further-along date than 7 days from the initial disclosure to Microsoft. Now that that's settled: I didn't move the goalposts at all. I called into question the inconsistency in your implied assertion that people know the details thanks to this disclosure: > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? People do not know the details. The disclosure gave enough to inform those not privy on where to look. It did not inform the world as to the details of the issue. I'd rather Google have disclosed nothing because as I've stated in the vast majority of my other comments. My position hasn't changed: no one is benefited by a public disclosure here other than • Google (getting people to use Chrome as a defensive measure even though arguably Edge has this one covered), and • any unprivy malware authors who now know where to look. Microsoft isn't going to act any more quickly here. Security vendors are already rolling out mitigations. Google's only advice was "use our browser" even though there are multiple solutions, both in terms of software (Edge) and advising on user actions for the general untargeted population. They included nothing other than: > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. You asserted that they disclosed the details, which Google did not. So now that my position is set clearly in stone without you able to turn it around with an argument about moving goalposts, let's get back to my current question: Since you asserted that Google disclosed the details even though they did not, would you rather have had the disclosure include the exact vulnerability? Edited for formatting.

deleted 10y ago

[deleted]

eganist 10y ago

> There's no mention of other browsers (so how could this be an ad for Chrome? Is Edge vulnerable? Is Firefox?) If this wasn't an ad and was merely a security disclosure, I'd have expected appropriate research into which configurations mitigate the risk, not just a single configuration which happens to favor the browser maker. Add on top of that the trivialization of "Windows 10" as the noun in a second-order preposition of place as well as the reference to Chrome as the primary subject of the sentence, and even basic analysis of the sentence in question shows a bias.

holtalanm 10y ago
The disclosure came from Google. Of course there's a bias if they spent time coming up with a mitigation within their software. They aren't responsible for other browsers, so why would they research fixes within those browsers? That assumption is just plain idiotic. They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome.
- eganist 10y ago
  > They are under NO responsibility to research each and every possible fix. Hell, they technically didn't even have to come up with a mitigation for Chrome. Then they should've waited until an official fix was out. They know one's being actively worked on. They know the primary exploit path (via Flash) was patched. To my earlier point: they should've just waited. > That assumption is just plain idiotic. That's not necessary. You might not see my face, but I'm still a person deserving of some amount of respect.
  - tptacek 10y ago
    Exactly what is the benefit of them waiting until an official fix is released if they have evidence of actual exploitation? How is anyone better off not knowing the details of a vulnerability that people are exploiting already? I'm having trouble making sense of your arguments on this thread, and I really am trying.
    - eganist 10y ago
      > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? This question is strange. On the one hand, the disclosure scares users into switching to Chrome even though Microsoft asserts Edge offers protection. On the other hand, the disclosure actually does not disclose the details of a vulnerability that people are exploiting already. Would you rather have had the disclosure include the exact vulnerability? I've addressed your other questions surrounding the benefits and drawbacks in other threads. No point in re-hashing them.
      - tptacek 10y ago
        No, you can't move the goalposts like this. You just said Google should have waited to disclose until a complete fix was published. In asserting that, you must also assert you'd rather have Google disclose nothing than something.
        eganist 10y ago
        I would rather Google disclose nothing to the public until there's a fix, or at least until a far-further-along date than 7 days from the initial disclosure to Microsoft. Now that that's settled: I didn't move the goalposts at all. I called into question the inconsistency in your implied assertion that people know the details thanks to this disclosure: > How is anyone better off not knowing the details of a vulnerability that people are exploiting already? People do not know the details. The disclosure gave enough to inform those not privy on where to look. It did not inform the world as to the details of the issue. I'd rather Google have disclosed nothing because as I've stated in the vast majority of my other comments. My position hasn't changed: no one is benefited by a public disclosure here other than • Google (getting people to use Chrome as a defensive measure even though arguably Edge has this one covered), and • any unprivy malware authors who now know where to look. Microsoft isn't going to act any more quickly here. Security vendors are already rolling out mitigations. Google's only advice was "use our browser" even though there are multiple solutions, both in terms of software (Edge) and advising on user actions for the general untargeted population. They included nothing other than: > Chrome's sandbox [...] prevents exploitation of this sandbox escape vulnerability. You asserted that they disclosed the details, which Google did not. So now that my position is set clearly in stone without you able to turn it around with an argument about moving goalposts, let's get back to my current question: Since you asserted that Google disclosed the details even though they did not, would you rather have had the disclosure include the exact vulnerability? Edited for formatting.