3 ms·

> In particular, we want to thank the Google Project Zero team for practicing responsible disclosure, creating the opportunity for the industry to address these

by wadkar 9y ago

> In particular, we want to thank the Google Project Zero team for practicing responsible disclosure, creating the opportunity for the industry to address these new issues in a coordinated fashion. I understand this a PR piece, and thus the use of the term "responsible disclosure". I believe the HN community disapproves of this terminology, and prefers usage of the term "coordinated disclosure". The question that I had was whether Google's project zero team prefers one term over another? Or in general, if you're a security researcher and have involved in reporting vulnerabilities - can you take a stand and emphasize "coordinated disclosure" term in your own articles? Edit: typos

Density 9y ago
Thanks for pointing out this little gem. I hope Google can be a little less responsible for independent company intel in the future.
- dogma1138 9y ago
  Google didn't respect the embargo for the financial sake of Intel but for both it's own sake and the sake of all of it's users, as well as most computer users out there regardless if they use Google services or not. Sure Intel put a PR spin on it, but any company would do that, but at least the patches were ready from the get go even tho the information started leaking a week prior to the official embargo date. Would you rather having to wait 2-4 months without any mitigating solutions other than turning off your PC? People are focusing too much on Meltdown, it's not the worse variant of Spectre, Variant 2 is much worse, and the possibility of future variants is even scarier. I don't see anything wrong with companies spending 5-6 months on coordinating mitigation and fixes as well as building knowledge that can be used for future research and prevention of similar vulnerabilities.
  - whyever 9y ago
    You seem to be assuming no one else found and exploited the vulnerability in the meantime.
    - dogma1138 9y ago
      Say someone has found it before, it's likely better to have 1 nation state exploiting it for 3 more months longer than every script kiddy on the block. These vulnerabilities affect nearly every CPU on the planet across all major CPU vendors, this isn't something your disclose immediately to teach someone a lesson or just to watch the world burn. Do you think Google would want to leave their infrastructure vulnerable for months?
mr_toad 9y ago
Project Zero discuss disclosure policy in some detail: https://googleprojectzero.blogspot.co.nz/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.co.nz/2015/02/feedback-an...
lewisinc 9y ago
I would not call this "responsible disclosure". If it were "responsible disclosure" ALL Operating System teams would have been informed ahead of time - not just those with the most market share. Those BSD guys are particularly pissed. Not to mention literally every else who is not Apple, Microsoft or a major Linux distro.

by wadkar 9y ago

Density 9y ago

Thanks for pointing out this little gem. I hope Google can be a little less responsible for independent company intel in the future.

dogma1138 9y ago
Google didn't respect the embargo for the financial sake of Intel but for both it's own sake and the sake of all of it's users, as well as most computer users out there regardless if they use Google services or not. Sure Intel put a PR spin on it, but any company would do that, but at least the patches were ready from the get go even tho the information started leaking a week prior to the official embargo date. Would you rather having to wait 2-4 months without any mitigating solutions other than turning off your PC? People are focusing too much on Meltdown, it's not the worse variant of Spectre, Variant 2 is much worse, and the possibility of future variants is even scarier. I don't see anything wrong with companies spending 5-6 months on coordinating mitigation and fixes as well as building knowledge that can be used for future research and prevention of similar vulnerabilities.
- whyever 9y ago
  You seem to be assuming no one else found and exploited the vulnerability in the meantime.
  - dogma1138 9y ago
    Say someone has found it before, it's likely better to have 1 nation state exploiting it for 3 more months longer than every script kiddy on the block. These vulnerabilities affect nearly every CPU on the planet across all major CPU vendors, this isn't something your disclose immediately to teach someone a lesson or just to watch the world burn. Do you think Google would want to leave their infrastructure vulnerable for months?

mr_toad 9y ago

Project Zero discuss disclosure policy in some detail: https://googleprojectzero.blogspot.co.nz/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.co.nz/2015/02/feedback-an...

lewisinc 9y ago

I would not call this "responsible disclosure". If it were "responsible disclosure" ALL Operating System teams would have been informed ahead of time - not just those with the most market share. Those BSD guys are particularly pissed. Not to mention literally every else who is not Apple, Microsoft or a major Linux distro.