3 ms·

From the article: > Google's security analysis efforts are appreciated and benefit the Android platform, however a company as powerful as Google should practic

From the article: > Google's security analysis efforts are appreciated and benefit the Android platform, however a company as powerful as Google should practice more responsible disclosure timing than this, and not endanger users in the course of its counter-PR efforts against Epic's distribution of Fortnite outside of Google Play. And Google expects researchers to disclose bugs on their platform to them before disclosing to public.

MBCook 8y ago
It wouldn’t surprise me if google did this as a sort of backhanded way of saying “see what happens when you don’t use our App Store?“
- ChuckMcM 8y ago
  Hardly back handed, more of a "this is what we do to you when ..." kind of thing.
- Rotdhizon 8y ago
  Epic is reckless for bypassing the play store, I'd be on the side of Google if this was their stance.
  - scottydelta 8y ago
    Not if they are creating such a big hole in the company's revenue(30%, source : https://arstechnica.com/gaming/2018/08/fortnite-on-android-may-drive-its-battle-bus-past-googles-30-cut/ https://arstechnica.com/gaming/2018/08/fortnite-on-android-m...) without bringing in something substantial. Epic already has a user base who would go to extra length by downloading the game's installer by visiting their website. So, it totally makes sense for Epic to bypass the playstore. From the article linked above: > Avoiding the 30 percent "store tax" is a part of Epic's motivation. It's a high cost in a world where game developers' 70 percent must cover all the cost of developing, operating, and supporting their games. And it's disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We're intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.
    - pvg 8y ago
      It doesn't seem like a very high cost if the other option is "getting your users' phones pwned".
DannyBee 8y ago
I like when "following standard practice, literally listed in the bug report and used 100's of times" is suddenly "counter-pr efforts" type: vulnerability is new, but if you search the public bug tracker for the phrase "This bug is subject to a 90-day disclosure deadline", you can see it all It looks like they have been pretty darn consistent about unrestricting once the patch is available. Usually faster than 7 days! They have also consistently held people to the 90 day requirement, and the 14 day grace extension they offer This is true even when the reporter is a googler or it affects only google software. This literally took me 5 minutes to look at and analyze. Instead of bothering to even look, epic decided it'd be better to issue a press release (as part of their pr efforts, ironically enough). If they want to complain (like others have!) and debate what the policy should be, that is one thing. However, the complaint that Google has treated them differently is clearly false. If they want to argue otherwise, the data is all right there for them to use.
shady-lady 8y ago
Also from the article: > Google's security team first disclosed the vulnerability privately to Epic Games on August 15, and has since released the information publicly following confirmation from Epic that the vulnerability was patched

MBCook 8y ago

It wouldn’t surprise me if google did this as a sort of backhanded way of saying “see what happens when you don’t use our App Store?“

ChuckMcM 8y ago
Hardly back handed, more of a "this is what we do to you when ..." kind of thing.
Rotdhizon 8y ago
Epic is reckless for bypassing the play store, I'd be on the side of Google if this was their stance.
- scottydelta 8y ago
  Not if they are creating such a big hole in the company's revenue(30%, source : https://arstechnica.com/gaming/2018/08/fortnite-on-android-may-drive-its-battle-bus-past-googles-30-cut/ https://arstechnica.com/gaming/2018/08/fortnite-on-android-m...) without bringing in something substantial. Epic already has a user base who would go to extra length by downloading the game's installer by visiting their website. So, it totally makes sense for Epic to bypass the playstore. From the article linked above: > Avoiding the 30 percent "store tax" is a part of Epic's motivation. It's a high cost in a world where game developers' 70 percent must cover all the cost of developing, operating, and supporting their games. And it's disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We're intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.
  - pvg 8y ago
    It doesn't seem like a very high cost if the other option is "getting your users' phones pwned".

DannyBee 8y ago

I like when "following standard practice, literally listed in the bug report and used 100's of times" is suddenly "counter-pr efforts" type: vulnerability is new, but if you search the public bug tracker for the phrase "This bug is subject to a 90-day disclosure deadline", you can see it all It looks like they have been pretty darn consistent about unrestricting once the patch is available. Usually faster than 7 days! They have also consistently held people to the 90 day requirement, and the 14 day grace extension they offer This is true even when the reporter is a googler or it affects only google software. This literally took me 5 minutes to look at and analyze. Instead of bothering to even look, epic decided it'd be better to issue a press release (as part of their pr efforts, ironically enough). If they want to complain (like others have!) and debate what the policy should be, that is one thing. However, the complaint that Google has treated them differently is clearly false. If they want to argue otherwise, the data is all right there for them to use.

shady-lady 8y ago

Also from the article: > Google's security team first disclosed the vulnerability privately to Epic Games on August 15, and has since released the information publicly following confirmation from Epic that the vulnerability was patched