3 ms·

Yes Google allows longer for bigger issues. Meltdown and Spectre two great examples. What surprises me is that so many of the really big ones seem to be found

Yes Google allows longer for bigger issues. Meltdown and Spectre two great examples. What surprises me is that so many of the really big ones seem to be found by Google. Spectre and Meltdown by multiple poeple. But Shellshock, Broadpwn, Heartbleed, and Cloudbleed if memory serves all found by Google. Off the top of my head can not think of a major one the last couple of years found by anyone but Google. Anyone else?

pvg 9y ago
Shellshock, Broadpwn were not originally reported by people working at Google, Heartbleed was also independently found by others.
ocdtrekkie 9y ago
Project Zero remains one of the few true gems at Google. They do good work. They probably don't call out their own employer as much as they should (understandable, considering), but they do darn good work, and have made a significant impact in making the Internet more secure. Everything from competitors' operating systems to browser extensions has gotten their attention, almost seemingly at random. I'd actually be super curious to know how they pick what they look into. Just a "hey, I wonder about this" while going about their day, or if they have some sort of agenda laid out for when to look at what software.
- seanmcdirmid 9y ago
  They probably call out their employer internally, know who to call directly when they find something, and so on. For stuff that isn't their own, the rules are probably very different. At least that is how I would run something like this.
  - xbmcuser 9y ago
    If I recall correctly a bug in chrome was disclosed before Google could fix it by the project zero team as the 3 month deadline had passed.
- jacksmith21006 9y ago
  Would say Google has a couple gems. DeepMind comes to mind. Also Google Brain has done some pretty interesting things. Probably my favorite of late is from Jeff Dean https://arxiv.org/abs/1712.01208 https://arxiv.org/abs/1712.01208 We just got YouTube TV recently and also something that is pretty impressive by Google and saves me a ton of money as my cable provider was awful charging for every TV monthly. Another example of something I find really interesting is Spanner. https://research.google.com/archive/spanner.html https://research.google.com/archive/spanner.html
794CD01 9y ago
Those who put resources into looking for security vulnerabilities find a lot. Of those groups, most have better things to do with those vulnerabilities than report them publicly. Who else is Google even competing against here?
- tptacek 9y ago
  There are lots of other vulnerability research teams. Google happens to have one of the best; they've recruited a decent slice of the best-known vulnerability researchers and then done a pretty excellent job of bringing up new people.

pvg 9y ago

Shellshock, Broadpwn were not originally reported by people working at Google, Heartbleed was also independently found by others.

ocdtrekkie 9y ago

Project Zero remains one of the few true gems at Google. They do good work. They probably don't call out their own employer as much as they should (understandable, considering), but they do darn good work, and have made a significant impact in making the Internet more secure. Everything from competitors' operating systems to browser extensions has gotten their attention, almost seemingly at random. I'd actually be super curious to know how they pick what they look into. Just a "hey, I wonder about this" while going about their day, or if they have some sort of agenda laid out for when to look at what software.

seanmcdirmid 9y ago
They probably call out their employer internally, know who to call directly when they find something, and so on. For stuff that isn't their own, the rules are probably very different. At least that is how I would run something like this.
- xbmcuser 9y ago
  If I recall correctly a bug in chrome was disclosed before Google could fix it by the project zero team as the 3 month deadline had passed.
jacksmith21006 9y ago
Would say Google has a couple gems. DeepMind comes to mind. Also Google Brain has done some pretty interesting things. Probably my favorite of late is from Jeff Dean https://arxiv.org/abs/1712.01208 https://arxiv.org/abs/1712.01208 We just got YouTube TV recently and also something that is pretty impressive by Google and saves me a ton of money as my cable provider was awful charging for every TV monthly. Another example of something I find really interesting is Spanner. https://research.google.com/archive/spanner.html https://research.google.com/archive/spanner.html

794CD01 9y ago

Those who put resources into looking for security vulnerabilities find a lot. Of those groups, most have better things to do with those vulnerabilities than report them publicly. Who else is Google even competing against here?

tptacek 9y ago
There are lots of other vulnerability research teams. Google happens to have one of the best; they've recruited a decent slice of the best-known vulnerability researchers and then done a pretty excellent job of bringing up new people.