4 ms·

Google has now found Cloudbleed, Heartbleed, Broadpwn, Spectre and Meltdown among others. Off the top of my head can not think of any big vulnerabilities found

Google has now found Cloudbleed, Heartbleed, Broadpwn, Spectre and Meltdown among others. Off the top of my head can not think of any big vulnerabilities found in the last couple years not discovered by Google. They pay engineers to find these and also pay bounties. This helps everyone including Google in the industry so would definitely still call them a nice guy. Maybe even a really nice guy? It is very difficult with vulnerabilities what you share and when. Once Spectre and Meltdown was shared we have many PoC also out. So script kiddies all set up to exploit. So it is not simple but have zero idea how you could suggest some how Google is a bad guy here? Also Google has also shared mitigations for Spectre that looks like a better approach to the broader community versus keeping as a competitive advantage. They even shared with Amazon a company that has banned ALL companies on their marketplace from being allowed to sell some of Googles products. Personally I am not nearly that nice.

stevekemp 9y ago
>Off the top of my head can not think of any big vulnerabilities found in the last couple years not discovered by Google. Shellshock?
- bostik 9y ago
  That's an interesting one. Original discovery was by Florian Weimer. Many of the Shellshock family bugs were discovered[ß] (IIRC) by Michal Zalewski, after David Wheeler announced that bash was likely infested with a whole bunch of additional parser bugs.[0] MZ is Employed by Google. Now, I think I recall MZ sharing at least some of the details of shellshock family bugs on his blog, so whether it goes under Google's umbrella or not might be subject to interpretation. I believe it's safe to say that the original bug was not discovered by Google, but it's subsequent manifestations, after the first round of fixes, were. 0: https://en.wikipedia.org/wiki/Shellshock_(software_bug) https://en.wikipedia.org/wiki/Shellshock_(software_bug) ß: can you say you "discovered" a bug if you are hunting on an already ripe ground with a fuzzer?
  - euyyn 9y ago
    Why ß though.
    - bostik 9y ago
      Because I wanted to avoid a naked asterisk. Index for references, something else for lesser footnotes. And no possibility to collide with emphasis parsing.

stevekemp 9y ago

>Off the top of my head can not think of any big vulnerabilities found in the last couple years not discovered by Google. Shellshock?

bostik 9y ago
That's an interesting one. Original discovery was by Florian Weimer. Many of the Shellshock family bugs were discovered[ß] (IIRC) by Michal Zalewski, after David Wheeler announced that bash was likely infested with a whole bunch of additional parser bugs.[0] MZ is Employed by Google. Now, I think I recall MZ sharing at least some of the details of shellshock family bugs on his blog, so whether it goes under Google's umbrella or not might be subject to interpretation. I believe it's safe to say that the original bug was not discovered by Google, but it's subsequent manifestations, after the first round of fixes, were. 0: https://en.wikipedia.org/wiki/Shellshock_(software_bug) https://en.wikipedia.org/wiki/Shellshock_(software_bug) ß: can you say you "discovered" a bug if you are hunting on an already ripe ground with a fuzzer?
- euyyn 9y ago
  Why ß though.
  - bostik 9y ago
    Because I wanted to avoid a naked asterisk. Index for references, something else for lesser footnotes. And no possibility to collide with emphasis parsing.