4 ms·
Project Zero is very well known for things exactly like this. Partially, it's because they are incredibly talented, but there are also talented people in academ
by gervase 9y ago
Project Zero is very well known for things exactly like this. Partially, it's because they are incredibly talented, but there are also talented people in academia and in other security consultancies. The biggest difference with Project Zero is that their primary [0] goal is altruistic: find vulnerabilities, and let people who can fix them know (vs publishing papers, securing paying clients, auctioning zero-days, etc), in the interests of making the internet and computing as a whole a safer place.
[0] Their secondary goals are to protect Google products and services, and to provide excellent PR in line with what we're discussing right here.
- kzrdude 9y agoHm that's tricky. These awesome findings didn't exactly provide net value for google, not even on the not so short term (next 10 years?). They've created a large problem for Google! :-)
- ehsankia 9y agoYes and no. The cost of some malicious party figuring it out and using it on Google would potentially been far greater than anything this could cost.
- oh_sigh 9y agoHow much value would be destroyed if black hats discovered the bug first and people started discovering that information from their Google cloud VMs was getting leaked? Sure, Google could just patch themselves, but the information to recreate the issue would surely be leaked by a xoogler, since it only takes a single sentence describing the vuln for a competent sec team to recreate it
- make3 9y agoDiscovering a vulnerability is not creating it. A vulnerability exists even if it was not publicly disclosed. There were probably other people already exploiting it.
- tanilama 9y agoImagine the law suit if Google fails to detect this....
- cjbprime 9y agoWorth noting that in this case, many of the authors are in academia. It wasn't solely a Google project.
- tonfa 9y agoI read it as it was an independent discovery by project zero and by academia researchers.
- ajasmin 9y agoIndependent discovery don't happen overnight. Intel must have been aware of these vulnerabilities for some time. edit: I'm sure everyone involved acted responsibly. I'm just curious as how far apart these independent discoveries were made. The bug has been around forever, but it must have been discovered relatively recently since it's not fixed in hardware yet. I've always been baffled by the concept of simultaneous discovery.
- teraflop 9y agoThe Spectre paper includes this line in the acknowledgements: > We would like to thank Intel for their professional handling of this issue through communicating a clear timeline and connecting all involved researchers.
- forgot-my-pw 9y ago
- asgioiobuio 9y agoOh, come on. Their only goal is to make Google money. The fact that they do useful work is a nice side effect, but if they didn't improve Google's security and give good PR there's not a chance in Hell Google would keep them around.
- deleted 9y ago[deleted]
- ComodoHacker 9y ago>their primary [0] goal is altruistic: ... making the internet and computing as a whole a safer place. Which is, at the same time, highly rational: to secure their entire market. It's nice to have big corp's incentives aligned with the public good. Too bad it happens so rarely.
- mason240 9y agoSuppose you have transportaion company that owns 80% of the market share for everything transported on the roads. By car, van, truck, semi, everything. Suppose your company also has a team that inspects public bridges to make sure they don't collapse. Is it really altruistic, or given your market share is it a cost of business?