4 ms·

I think that represents a fundamental misunderstanding of Google's incentives. (disclaimer: I'm typing this from Google, but it's purely my own opinion.) (An

by dgacmu 10y ago

I think that represents a fundamental misunderstanding of Google's incentives. (disclaimer: I'm typing this from Google, but it's purely my own opinion.) (And wishing my experiment would finish running faster.) Google's biggest revenue stream is ads. It has many others, but that's the big one. Ads are seen by people who use Google search, and who browse many ad-supported websites. Google also has a lot of users of its services, e.g., gmail, who have accounts. Some also entrust valuable data to Google. Google therefore has a great deal of incentive to make sure that: (a) Nobody messes with the ability of general users to browse the Internet safely (preserving ad revenue); and (b) It's very hard to compromise users computers and gain access to their Google/gmail/whatever accounts (reducing support costs and keeping users happy), or destroy their data, or exfiltrate it. Even if the compromise was the user's computer, it's still a very bad experience. Project zero is a pretty good example of this incentive structure in action. (such as fuzzing for windows font bugs: https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... ). With fuzzing itself, as DannyBee alluded to below, one of the leads of a lot of this infrastructure, Kostya Serebryany, is also personally passionate about seeing it be taken up to make the software of the world better. I've seen this in action - he convinced me to use libFuzzer to improve TensorFlow's robustness, and mentioned that he was doing so in part so I'd take that experience back to Carnegie Mellon and spread the word. :) (and it worked - https://github.com/tensorflow/tensorflow/commit/7231d01fcb2cd9ef9ffbfea03b724892c8a4026e https://github.com/tensorflow/tensorflow/commit/7231d01fcb2c... for example).

ocdtrekkie 10y ago
One could argue, especially considering some of the disclosure situations surrounding Project Zero that have occurred, that it exists more to shame competitors than improve the world. :) To my knowledge, only like once have I heard the words "Project Zero" in relation to a flaw in Google software. But as Google definitely does do security testing on competitors' products such as Windows, it definitely goes to show that Google would be more than happy to test for security flaws in Firefox. And regardless of Google's motives, finding security flaws does, in the end, make a more secure Internet for everybody.
- halbecaf 10y ago
  Project Zero has reported plenty of bugs in Google software: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=vendor%3AGoogle https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
  - username223 10y ago
    That's encouraging -- I had cynically assumed it was just a naive PR play -- but have they screwed over other Google projects by publishing 0-days at the end of their arbitrary time window? For example, do they publish zero-days on widely-deployed versions of Android?
    - dgacmu 10y ago
      I believe they follow the same reporting process regardless of vendor, Google included. Here's one that Google fixed in Chrome about 15 days before the 90 day public release threshold: https://bugs.chromium.org/p/project-zero/issues/detail?id=162&can=1&q=&start=100 https://bugs.chromium.org/p/project-zero/issues/detail?id=16... (You'll note the explicit discussion in there about the deadline: "Chromium issues should be treated the same as any others. So there's a 90-day deadline (which was not exceeded in this case), ... Same disclosure warning to the Chrome team was in this bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=513&can=1&q=&start=400 https://bugs.chromium.org/p/project-zero/issues/detail?id=51... And project zero explicitly warned the Android team about the 90 day disclosure policy in the one bug report I checked: https://code.google.com/p/android/issues/detail?id=182510 https://code.google.com/p/android/issues/detail?id=182510 Edited to add: Here's one where they disclosed prior to Android fixing the bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=860&q= https://bugs.chromium.org/p/project-zero/issues/detail?id=86... with the note "deadline exceeded". Unfortunately, the link to the Android bug is still protected, so we can't learn why AOSP hasn't fixed it yet.

by dgacmu 10y ago

ocdtrekkie 10y ago

One could argue, especially considering some of the disclosure situations surrounding Project Zero that have occurred, that it exists more to shame competitors than improve the world. :) To my knowledge, only like once have I heard the words "Project Zero" in relation to a flaw in Google software. But as Google definitely does do security testing on competitors' products such as Windows, it definitely goes to show that Google would be more than happy to test for security flaws in Firefox. And regardless of Google's motives, finding security flaws does, in the end, make a more secure Internet for everybody.

halbecaf 10y ago
Project Zero has reported plenty of bugs in Google software: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=vendor%3AGoogle https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- username223 10y ago
  That's encouraging -- I had cynically assumed it was just a naive PR play -- but have they screwed over other Google projects by publishing 0-days at the end of their arbitrary time window? For example, do they publish zero-days on widely-deployed versions of Android?
  - dgacmu 10y ago
    I believe they follow the same reporting process regardless of vendor, Google included. Here's one that Google fixed in Chrome about 15 days before the 90 day public release threshold: https://bugs.chromium.org/p/project-zero/issues/detail?id=162&can=1&q=&start=100 https://bugs.chromium.org/p/project-zero/issues/detail?id=16... (You'll note the explicit discussion in there about the deadline: "Chromium issues should be treated the same as any others. So there's a 90-day deadline (which was not exceeded in this case), ... Same disclosure warning to the Chrome team was in this bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=513&can=1&q=&start=400 https://bugs.chromium.org/p/project-zero/issues/detail?id=51... And project zero explicitly warned the Android team about the 90 day disclosure policy in the one bug report I checked: https://code.google.com/p/android/issues/detail?id=182510 https://code.google.com/p/android/issues/detail?id=182510 Edited to add: Here's one where they disclosed prior to Android fixing the bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=860&q= https://bugs.chromium.org/p/project-zero/issues/detail?id=86... with the note "deadline exceeded". Unfortunately, the link to the Android bug is still protected, so we can't learn why AOSP hasn't fixed it yet.