3 ms·

tl;dr -- This isn't unpaid work. Ethics come into play when a company is paying people to hack other companies' software. Google's Project Zero is a brilliant

tl;dr -- This isn't unpaid work. Ethics come into play when a company is paying people to hack other companies' software. Google's Project Zero is a brilliant PR play, but it's walking a fine line ethically. Google pays some engineers to hack other companies' software, then publicizes the results. Given its recent troubles, Uber could benefit from hiring a few gray-hats, pointing them at Google, and releasing some of the resulting bugs under an arbitrary "responsible disclosure" policy.

kbenson 10y ago
It's only a fine line if you think everything they find would remain unfound without them. It's sort of like saying Consumer Reports walks a fine line if they alert the public about any dangerous behavior they see in the products they test. The danger is always there, telling people about it so they can avoid it and it can be fixed is to the public's benefit.
- username223 10y ago
  I don't think Consumer Reports rates other product review sites with which it directly competes. Project Zero is more like politicians paying for opposition research. You can argue that it benefits the public to have dirty deeds exposed by any means necessary, but it's hard to call it altruistic.
  - kbenson 10y ago
    That's one way to look at it. Another way s that they are subsidizing the security team of their competitors. Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway. Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money. 1: https://googleprojectzero.blogspot.com/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.com/2015/02/feedback-and-...

kbenson 10y ago

It's only a fine line if you think everything they find would remain unfound without them. It's sort of like saying Consumer Reports walks a fine line if they alert the public about any dangerous behavior they see in the products they test. The danger is always there, telling people about it so they can avoid it and it can be fixed is to the public's benefit.

username223 10y ago
I don't think Consumer Reports rates other product review sites with which it directly competes. Project Zero is more like politicians paying for opposition research. You can argue that it benefits the public to have dirty deeds exposed by any means necessary, but it's hard to call it altruistic.
- kbenson 10y ago
  That's one way to look at it. Another way s that they are subsidizing the security team of their competitors. Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway. Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money. 1: https://googleprojectzero.blogspot.com/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.com/2015/02/feedback-and-...