8 ms·

Google also has full interest in showing Microsoft failures. Microsoft could do the same about Chrome. How goid are competitive markets.

by tajen 10y ago

jacquesm 10y ago
Sad to see this downvoted, but it's definitely war of some sort between Google and Microsoft and Google actively targeting MS products could easily be a factor. Altruism it likely isn't. Keep in mind that the Google docs/drive/whatever suite is the competitor for Microsofts Office 365 product. Has Google ever released info about an unpatched critical bug on their own systems/applications?
- kps 10y ago
  > Has Google ever released info about an unpatched critical bug on their own systems/applications? https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label%3ADeadline-Exceeded+label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
  - jacquesm 10y ago
    Thank you for digging that up. Are those critical? Not according to the text accompanying them, or am I missing something.
    - andreyf 10y ago
      This one seems pretty bad: https://bugs.chromium.org/p/project-zero/issues/detail?id=1000&can=1&q=label%3ADeadline-Exceeded%20label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/detail?id=10...
      - jacquesm 10y ago
        Yes, but when the deadline expired the APK part was already fixed, the remainder is still open.
- deleted 10y ago
  [deleted]
- jkn 10y ago
  All the data I have seen point to "altruism" [1] more than a war with Microsoft. Consider the list of Project Zero reports where the deadline was exceeded (thanks to brainfog for the URL): https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label%3ADeadline-Exceeded&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids https://bugs.chromium.org/p/project-zero/issues/list?can=1&q... [1] Certainly not literally altruism. I suppose Google thinks this projects benefits everybody including themselves.
  - jacquesm 10y ago
    > I suppose Google thinks this projects benefits everybody including themselves. That's quite possible but once you start releasing unpatched vulnerabilities about competitor products there is at least a chance that 'including themselves' trumps 'everybody'. It's not like we haven't been here before: http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... So, google made a nice little 'hands-off' automatic disclosure feature which gives them a reason to say 'computer did it' but I don't think for an instant 'altruism' of any kind is the reason they do this. If google really had the well-being of internet users at heart they'd shut down google analytics and stop accumulating profiles. Until they do that my money is on Google estimating that they will do others more damage than they will do themselves through Project Zero and as such yes, we will all benefit but Google will benefit the most of all.
    - dsacco 10y ago
      That's a false dichotomy, and it's also a very one dimensional take on what altruism means in the context of capitalism. There is a world of nuanced altruism between "has analytics that violate some peoples' privacy expectations" and "totally altruistic." What's more, their analytics have nothing to do with the point at hand. Why even bring it up, except as an opportunity for a tangential soapbox? We're talking about disclosure timelines.
      - jacquesm 10y ago
        It has a lot to do with the point at hand because you can't really attack Microsoft on their web tracking because they don't do any. So if Google wanted to attack MS on the subject of privacy they'd have to go all the way to Skype to get some traction. So instead they attack on a front where Google is strong and Microsoft slightly weaker. Google is anything but altruistic, their each and every move is to improve the bottom line for Google and their shareholders. If something is really altruistic it likely falls in their PR budget.
- chc 10y ago
  > Has Google ever released info about an unpatched critical bug on their own systems/applications? It seems pretty unreasonable to fault Google if the answer is "No, because they patch critical bugs in a timely manner."
  - jacquesm 10y ago
    Advance knowledge helps: such as: knowing well prior to the initial report that your people are working on something. Or you might decide not to record the flaw until a fix is in the works. There is so much missing in terms of transparency here. For instance: was there positive confirmation the message was received by the right people at the vendor? Was there any attempt at communication as the expiry date drew close? Of course the onus is technically on Microsoft but Google has been at this before and it did not look clean to me at the time. I can't believe I'm defending MS here. I'm all for competitors keeping each other sharp but it helps to keep in mind they're competitors first. One possible way around this is to set up something like project 0 independent of Google, Microsoft and so on and have all of them commit to contributing funding to keep it alive.
- dgacmu 10y ago
  The last time this came up, I started making a little list in a thread comment, here: https://news.ycombinator.com/item?id=13085619 https://news.ycombinator.com/item?id=13085619 The answer is: Yes, thev're had critical Android bugs pass the deadline. And what I wrote 88 days ago still holds - still can't see what the actual android bug says, which is annoying. (FD: Google pays me a day per week, but they don't pay me to spout of on HN in the evenings; this is all my opinionated opinion. :-)
neurotech1 10y ago
IMHO There should be an in between step, not just 90 day timeout for full disclosure, and saying nothing. Maybe CVE ID and vague description, then extend full disclosure by 7-14 days.
- notyourwork 10y ago
  I disagree, 90 days is sufficient time to work offline with the reporting entity. If they cannot come to agreement in 90 days what is another <arbitrary amount of time> going to matter? It just further extends what they are already doing, not prioritizing it.

Google also has full interest in showing Microsoft failures. Microsoft could do the same about Chrome. How goid are competitive markets.

by tajen 10y ago

Google also has full interest in showing Microsoft failures. Microsoft could do the same about Chrome. How goid are competitive markets.

jacquesm 10y ago

Sad to see this downvoted, but it's definitely war of some sort between Google and Microsoft and Google actively targeting MS products could easily be a factor. Altruism it likely isn't. Keep in mind that the Google docs/drive/whatever suite is the competitor for Microsofts Office 365 product. Has Google ever released info about an unpatched critical bug on their own systems/applications?

kps 10y ago
> Has Google ever released info about an unpatched critical bug on their own systems/applications? https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label%3ADeadline-Exceeded+label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- jacquesm 10y ago
  Thank you for digging that up. Are those critical? Not according to the text accompanying them, or am I missing something.
  - andreyf 10y ago
    This one seems pretty bad: https://bugs.chromium.org/p/project-zero/issues/detail?id=1000&can=1&q=label%3ADeadline-Exceeded%20label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/detail?id=10...
    - jacquesm 10y ago
      Yes, but when the deadline expired the APK part was already fixed, the remainder is still open.
deleted 10y ago
[deleted]
jkn 10y ago
All the data I have seen point to "altruism" [1] more than a war with Microsoft. Consider the list of Project Zero reports where the deadline was exceeded (thanks to brainfog for the URL): https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label%3ADeadline-Exceeded&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids https://bugs.chromium.org/p/project-zero/issues/list?can=1&q... [1] Certainly not literally altruism. I suppose Google thinks this projects benefits everybody including themselves.
- jacquesm 10y ago
  > I suppose Google thinks this projects benefits everybody including themselves. That's quite possible but once you start releasing unpatched vulnerabilities about competitor products there is at least a chance that 'including themselves' trumps 'everybody'. It's not like we haven't been here before: http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure http://www.theverge.com/2016/10/31/13481502/windows-vulnerab... So, google made a nice little 'hands-off' automatic disclosure feature which gives them a reason to say 'computer did it' but I don't think for an instant 'altruism' of any kind is the reason they do this. If google really had the well-being of internet users at heart they'd shut down google analytics and stop accumulating profiles. Until they do that my money is on Google estimating that they will do others more damage than they will do themselves through Project Zero and as such yes, we will all benefit but Google will benefit the most of all.
  - dsacco 10y ago
    That's a false dichotomy, and it's also a very one dimensional take on what altruism means in the context of capitalism. There is a world of nuanced altruism between "has analytics that violate some peoples' privacy expectations" and "totally altruistic." What's more, their analytics have nothing to do with the point at hand. Why even bring it up, except as an opportunity for a tangential soapbox? We're talking about disclosure timelines.
    - jacquesm 10y ago
      It has a lot to do with the point at hand because you can't really attack Microsoft on their web tracking because they don't do any. So if Google wanted to attack MS on the subject of privacy they'd have to go all the way to Skype to get some traction. So instead they attack on a front where Google is strong and Microsoft slightly weaker. Google is anything but altruistic, their each and every move is to improve the bottom line for Google and their shareholders. If something is really altruistic it likely falls in their PR budget.
chc 10y ago
> Has Google ever released info about an unpatched critical bug on their own systems/applications? It seems pretty unreasonable to fault Google if the answer is "No, because they patch critical bugs in a timely manner."
- jacquesm 10y ago
  Advance knowledge helps: such as: knowing well prior to the initial report that your people are working on something. Or you might decide not to record the flaw until a fix is in the works. There is so much missing in terms of transparency here. For instance: was there positive confirmation the message was received by the right people at the vendor? Was there any attempt at communication as the expiry date drew close? Of course the onus is technically on Microsoft but Google has been at this before and it did not look clean to me at the time. I can't believe I'm defending MS here. I'm all for competitors keeping each other sharp but it helps to keep in mind they're competitors first. One possible way around this is to set up something like project 0 independent of Google, Microsoft and so on and have all of them commit to contributing funding to keep it alive.
dgacmu 10y ago
The last time this came up, I started making a little list in a thread comment, here: https://news.ycombinator.com/item?id=13085619 https://news.ycombinator.com/item?id=13085619 The answer is: Yes, thev're had critical Android bugs pass the deadline. And what I wrote 88 days ago still holds - still can't see what the actual android bug says, which is annoying. (FD: Google pays me a day per week, but they don't pay me to spout of on HN in the evenings; this is all my opinionated opinion. :-)

neurotech1 10y ago

IMHO There should be an in between step, not just 90 day timeout for full disclosure, and saying nothing. Maybe CVE ID and vague description, then extend full disclosure by 7-14 days.

notyourwork 10y ago
I disagree, 90 days is sufficient time to work offline with the reporting entity. If they cannot come to agreement in 90 days what is another <arbitrary amount of time> going to matter? It just further extends what they are already doing, not prioritizing it.