3 ms·

Whether google should disclose after 90 days or not is up for debate maybe, but i for one applaud the effort. Many many years, exploits have gone undetected/unp

Whether google should disclose after 90 days or not is up for debate maybe, but i for one applaud the effort. Many many years, exploits have gone undetected/unpatched. If googles approach is to force people fix them, so be it. Microsoft has no right to be angry - they should be thankful. This is peoples data, their business at risk. After being in the business for so long time, and with the resources they have, they can afford to put a small army of swes to fix security bugs. Unlike a small company, the bugs in widely used software, by definition, affects a large set of people. Disclaimer: google employee.

kovek 9y ago
On the topic of Google finding issues in others' software: I am wondering how do the engineers at Google that work on finding software issues or vulnerabilities approach that kind of work? Is there a way to heuristically find security vulnerabilities and software issues? Edit: Especially when those vulnerabilities need so much work to be revealed, like the meltdown/spectre issues we heard about recently
- forgot-my-pw 9y ago
  Read a lot of security papers, test commonly known vulnerabilities and techniques, etc. Here's the backstory on Meltdown specifically: https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-year-old-discovered-the-worst-chip-flaws-in-history https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-...
zamalek 9y ago
> If googles approach is to force people fix them, so be it. That's not actually what responsible disclosure is for. Responsible disclosure is a process that [correctly] assumes that a malicious third party has also discovered the bug and is currently exploiting it or selling it, but acknowledges the assumption. If you disclosed bugs immediately, the could be novel and you could have let the cat out of the bag. If you never disclose bugs, they could already be in the wild and doing damage. Forcing Microsoft to fix it is just a beneficial side-effect.
- lawnchair_larry 9y ago
  That’s called coordinated disclosure. There can be no such thing as “responsible” disclosure, and Microsoft has disavowed that term.

kovek 9y ago

On the topic of Google finding issues in others' software: I am wondering how do the engineers at Google that work on finding software issues or vulnerabilities approach that kind of work? Is there a way to heuristically find security vulnerabilities and software issues? Edit: Especially when those vulnerabilities need so much work to be revealed, like the meltdown/spectre issues we heard about recently

forgot-my-pw 9y ago
Read a lot of security papers, test commonly known vulnerabilities and techniques, etc. Here's the backstory on Meltdown specifically: https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-year-old-discovered-the-worst-chip-flaws-in-history https://www.bloomberg.com/news/articles/2018-01-17/how-a-22-...

zamalek 9y ago

> If googles approach is to force people fix them, so be it. That's not actually what responsible disclosure is for. Responsible disclosure is a process that [correctly] assumes that a malicious third party has also discovered the bug and is currently exploiting it or selling it, but acknowledges the assumption. If you disclosed bugs immediately, the could be novel and you could have let the cat out of the bag. If you never disclose bugs, they could already be in the wild and doing damage. Forcing Microsoft to fix it is just a beneficial side-effect.

lawnchair_larry 9y ago
That’s called coordinated disclosure. There can be no such thing as “responsible” disclosure, and Microsoft has disavowed that term.