5 ms·

Denying the deadline extension to May 8th [1] is quite a dick move by Google, considering that it took them 6 months to fix the extremely harmful sitemap rankin

by foepys 9y ago

Denying the deadline extension to May 8th [1] is quite a dick move by Google, considering that it took them 6 months to fix the extremely harmful sitemap ranking bug in their search engine[2]. And after they fixed the bug, they only paid peanuts to the researcher for a bug that could've cost Google's customers tens of millions in misplaced ad campaigns. 1: https://bugs.chromium.org/p/project-zero/issues/detail?id=1514#c3 https://bugs.chromium.org/p/project-zero/issues/detail?id=15... 2: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/ http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-byp...

saagarjha 9y ago
It seems that the researcher was relatively happy with the outcome. They could have certainly gone public far earlier if they had chosen to do so.
JumpCrisscross 9y ago
> that could've cost Google's customers tens of millions in misplaced ad campaigns You're comparing an operating system security bug to advertisers' lives being made inconvenient.
- pookeh 9y ago
  Yeah so? Both involve tons of money.
  - annabellish 9y ago
    One can have a material impact on people's security, and thus everything from financial stability to physical safety. The other results in some companies making less money via advertising than they otherwise would have. Both involve money, but let's not pretend that the more money involved, the more important something is.
    - ocdtrekkie 9y ago
      A company being driven out of business by advertising practices, having to let their employees go, and merely hope they can find new jobs, certainly impacts their financial stability, and likely their physical safety.
- deleted 9y ago
  [deleted]
deleted 9y ago
[deleted]
jhall1468 9y ago
First of all, Google has no responsibility to give any period of time. It isn't a "dick move". Second, the researcher in question: 1) Never gave a required date for disclosure. 2) Upon requesting the right to disclose, was told no and he followed suit. 3) Was initially offered a bug bounty of $1300, which was upgraded to $5000. He apparently never bartered on that issue at all. So your entire post was completely irrelevant.
- s2g 9y ago
  Disclosing unpatched vulnerabilities when the company is asking for an extension of a few weeks to patch is absolutely a dick more and extremely irresponsible.
  - bigiain 9y ago
    Seems the researcher's response was something like: "Hey, you know how your front and back door are both unlocked and everybody already knows about it? Well, your bathroom window is open too - so if someone gets past the front gate, across the moat, and into the castle - there's a third unlocked way onto the living quarters." It's not like _this_ bug alone would get anybody RCE - they'd need to chain up some other way in, and if they've done that there are at least two known and unpatched bugs that'd get them the same place as this one already. It's just as easy to argue that pushing for extensions to disclosures that aren't going to decrease security is the dick move here...
  - lvh 9y ago
    What is an acceptable amount of time? Why isn’t 90 days the correct number? A comparable bug has been out since Aug2017 and MS hasn’t patched it. Is a year the right number? Does everyone get that extension by asking? How does that help anyone but the people who own the bugs to save face publicly and attackers more time to exploit the bug?
- dingo_bat 9y ago
  > First of all, Google has no responsibility to give any period of time. Any security researcher has a responsibility to disclose a vulnerability in such a way that it does not cause widespread damage. I don't know why you would think otherwise.

by foepys 9y ago

saagarjha 9y ago

It seems that the researcher was relatively happy with the outcome. They could have certainly gone public far earlier if they had chosen to do so.

JumpCrisscross 9y ago

> that could've cost Google's customers tens of millions in misplaced ad campaigns You're comparing an operating system security bug to advertisers' lives being made inconvenient.

pookeh 9y ago
Yeah so? Both involve tons of money.
- annabellish 9y ago
  One can have a material impact on people's security, and thus everything from financial stability to physical safety. The other results in some companies making less money via advertising than they otherwise would have. Both involve money, but let's not pretend that the more money involved, the more important something is.
  - ocdtrekkie 9y ago
    A company being driven out of business by advertising practices, having to let their employees go, and merely hope they can find new jobs, certainly impacts their financial stability, and likely their physical safety.
deleted 9y ago
[deleted]

deleted 9y ago

[deleted]

jhall1468 9y ago

First of all, Google has no responsibility to give any period of time. It isn't a "dick move". Second, the researcher in question: 1) Never gave a required date for disclosure. 2) Upon requesting the right to disclose, was told no and he followed suit. 3) Was initially offered a bug bounty of $1300, which was upgraded to $5000. He apparently never bartered on that issue at all. So your entire post was completely irrelevant.

s2g 9y ago
Disclosing unpatched vulnerabilities when the company is asking for an extension of a few weeks to patch is absolutely a dick more and extremely irresponsible.
- bigiain 9y ago
  Seems the researcher's response was something like: "Hey, you know how your front and back door are both unlocked and everybody already knows about it? Well, your bathroom window is open too - so if someone gets past the front gate, across the moat, and into the castle - there's a third unlocked way onto the living quarters." It's not like _this_ bug alone would get anybody RCE - they'd need to chain up some other way in, and if they've done that there are at least two known and unpatched bugs that'd get them the same place as this one already. It's just as easy to argue that pushing for extensions to disclosures that aren't going to decrease security is the dick move here...
- lvh 9y ago
  What is an acceptable amount of time? Why isn’t 90 days the correct number? A comparable bug has been out since Aug2017 and MS hasn’t patched it. Is a year the right number? Does everyone get that extension by asking? How does that help anyone but the people who own the bugs to save face publicly and attackers more time to exploit the bug?
dingo_bat 9y ago
> First of all, Google has no responsibility to give any period of time. Any security researcher has a responsibility to disclose a vulnerability in such a way that it does not cause widespread damage. I don't know why you would think otherwise.