9 ms·

Google is irresponsible, claims Fortnite's chief in bug row

76 points by AndrewDucker 8y ago

chipgap98 8y ago
> creating an unnecessary risk for Android users in order to score cheap PR points This seems like an accurate take. Why else would google disclose the bug so quickly?
- mortehu 8y ago
  Because a week had elapsed since the batch became broadly available. Epic is missing a way to push out updates, so they wanted more time.
- hs86 8y ago
  Google usually gives you 90 days for coordinated disclosure but if you deploy a patch to fix it, the disclosure happens earlier. Epic still requested the full 90 days and Google disagreed: https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336
- 21 8y ago
  To reinforce the idea that the only way to safely get apps on Android is through it's store.
  - Piskvorrr 8y ago
    Note that is not the same thing as "get safe apps" - just that the app hasn't been tampered with between the publisher and you. There seems to be a lot of spyware on the Play store still (or whatever it's called this week).
  - close04 8y ago
    "Safely". https://venturebeat.com/2018/01/30/google-play-removed-700000-bad-apps-in-2017-70-more-than-in-2016/ https://venturebeat.com/2018/01/30/google-play-removed-70000...
- hb3b 8y ago
  Google seems in the right here. The disclosure was in line with their policy and I'm sure it made management feel oh so good to burn Fortnite in public for their decision to forego distribution in the Play Store. But here's my personal take. As a consumer I want my phones to run secure apps on secure operating systems. This has a cost obviously which is fair to pass on to developers. It's clear to me, with all the rogue apps and crap in the Play Store that Google is not investing enough in managing app store content. Fortnite won this battle but in my book Apple will win the war.
  - justonepost 8y ago
    You mean google? You're right though, Google does a crap job auditing the playstore. It's ludicrous how they'll allow apps get access to everything on the phone without any kind of serious warning to the user. My kids install all sorts of crap. I've warned them that all their texts and photos will end up on the internet because of it. Not highly probable, but certainly possible. Makes for a useful double check they're not texting anything silly.
    - nordsieck 8y ago
      >> It's clear to me, with all the rogue apps and crap in the Play Store that Google is not investing enough in managing app store content. >> >> Fortnite won this battle but in my book Apple will win the war. > You mean google? He's saying that Apple, is doing a much better job of "managing app store content" than Google, and so ultimately it doesn't matter if Fortnite or Apple wins this battle: they're fighting over a mound of rubble while Apple builds a castle.
      - oblio 8y ago
        > they're fighting over a mound of rubble while Apple builds a castle It doesn't matter. Apple doesn't win in the end. In the other Apple vs mound of rubble fight (Windows), Apple lost. Android is doing the same thing. Android 4.0 was Windows 3.1 (first Android version to be "modern", IMO), Android 5.0 was Windows 95 (better UX). Android now just needs Windows XP to be stable enough (I'd argue Android 8.0 was that) and Windows 7 to cover the security aspects (most likely wide spread adoption of new Android permissions). But the writing is kind of on the wall, outside the US Android has majority market share and it's only going up.
- vorpalhex 8y ago
  Google has very public disclosure deadlines that they followed in this case. The patch was out, Google told people to update. Alternatively, Google could of let users continue running unpatched software until the 90 days expired...
deleted 8y ago
[deleted]
seibelj 8y ago
Aren’t you allowed to use whatever payment service you want inside an Android app, and avoid Google’s in-app payments? Then you avoid the cut to google. Or have I been violating the agreement for years...
- steiger 8y ago
  You can only do this if the payment is not for digital goods obtained and used in the app. Otherwise, it's a violation of TOS.
cletus 8y ago
Sorry, I'm with Google on this one. Epic chose to go off the reservation (so to speak) and created a giant security hole while doing it. Woops. This part of the article covers this: > Google's disclosure rules state that it reveals details of bugs to the public 90 days after reporting them to the developers responsible if they have not been tackled, but only waits one week after a patch is made "broadly available". So Epic made a patch available and Google waited a week. But: > ... [Time Sweeney] denied suggestions that the tech giant had acted in users' interests by refusing to keep the matter private until mid-November. The 90 days is for unaddressed bugs. This is nothing more than an attempt by Epic to fix bad PR from a security vulnerability they introduced (which arguably at this nascent stage might reduce public confidence in their bypassing the Play Store) by trying to deflect it onto Google. And I get the desire to skip the 30% cut but if you're going to do that you're then responsible for the safety of a person's phone and data. At least be up to the task.
rawrmaan 8y ago
Man, I had to read that headline like 10 times before it made sense. /r/titlegore
- arghwhat 8y ago
  Same. Quotation marks are important, people!
  - jaegerpicker 8y ago
    Totally, I first that was is that even English.
- kbsletten 8y ago
  I also never use "row" to mean a fight, so I read that as "bug row" (like "skid row", or "cannery row") and couldn't figure out what was even going on.
microcolonel 8y ago
Don't they have an in-app updater? Why does it take more than a week for updates to propagate?
pjmlp 8y ago
I side on Google on this one. Want the profits? Then use them to actually make a safe product.
- justonepost 8y ago
  7 days seems awfully short and not in the interest of users.
  - r3bl 8y ago
    Seven days after the patch, not after disclosure with Epic. Epic patched it on August 17th, Google waited 7 more days (as it is their usual practice) and then they went public. Issue tracker makes more sense than the article IMO: https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336 I guess that usually seven days is more than enough for everyone to update to the latest version available on the Play store, however downloading a giant .apk file within seven days is an inconvenience for most users, which is why Epic requested 90.
    - detaro 8y ago
      Also, Playstore checks for you in the background for updates even if you don't use the app in question, the Fortnite launcher doesn't.
- throwaway917100 8y ago
  What if I tomorrow figure out a bug in Gmail/adsense and release it public-ally without giving google a chance to fix it. My logic : Want security, stop recording peoples data. ( The most secure way to store data is not store data in the first place) Would that be fair to google and the consumers of google. And I would bet that I would be booked under some "Hacking" related law for doing that.
  - joshuamorton 8y ago
    That would be completely different than publishing a bug a week after it was patched.
Someone1234 8y ago
I'd argue that Epic is irresponsible for putting users into this position to start with. All Google did was tell users that they need to update ASAP as they're ALREADY in a compromised position. If there was no update/patch, I might side with Epic, but as soon as the fix was out and everyone needed to update, users needed to know the risks of inaction would inhibit. Not least of all because people may start reverse engineering the patch. Epic has decided this is revenge for them not using Google Play, but if you look at Google's bug efforts historically, this has always been how they handled these issues. They've been highly consistent about it. If Epic wants to keep serious security bugs under wraps in the future, maybe they shouldn't rely on unpaid third parties to audit their code. PS - Google gave them 7 days from patch release, so most auto-updaters likely updated the installer.
- justonepost 8y ago
  They're both in the wrong. Epic for screwing it up and rushing rather than investing in security, and Google for trying to score PR points at the expense of their users. Google is being anti-secure here by not allowing the update to filter through the ecosystem.
  - Someone1234 8y ago
    > Google for trying to score PR points at the expense of their users. Except this is how Google has always handled these bugs. The article even links to other examples involving other companies. > Google is being anti-secure here by not allowing the update to filter through the ecosystem. Or pro-secure here by telling users to urgently update rather than doing nothing and hoping nobody spots the bug and starts exploiting it before users get lucky.
    - zaarn 8y ago
      Well, it's not that there is nothing being done. You're distributing the patch. You don't have to go yelling about the fact you're distributing a highly important security patch, that only draws the attention of the bad guys. Wanting to distribute such patches as low profile is a valid choice and is not "doing nothing and waiting to people to exploit it".
Dwolb 8y ago
The only other thing I’d do here as Fortnite’s Chief is to broadly make secure install infrastructure available to other indie developers. This would gain some goodwill and could turn into another revenue stream. +1 points for turning this issue into more publicity.
- Someone1234 8y ago
  > make secure install infrastructure available to other indie developers Epic doesn't have "secure" install infrastructure, that's the whole crux of this issue.
  - jessaustin 8y ago
    Sure but they are a capable well-capitalized development organization. Such infrastructure is not an impossible technology; numerous open source implementations exist. Therefore they will have such infrastructure sometime in the next 6 months. When they have it, they can offer it as a service to other organizations whose interests are similarly opposed to Google's.
    - Kalium 8y ago
      You're absolutely, completely right! Secure infrastructure is possible and numerous implementations exist. Given how right you are, it's exceptionally odd that a capable well-capitalized development organization would not use such systems and manage such a basic mistake.
      - jessaustin 8y ago
        "Poor decision by management hoping to save some money" is not a rare event.
        Kalium 8y ago
        For that matter, neither is a poor decision made by engineers who think it's fun to reinvent wheels. Both have happened plenty in history.
chuckgreenman 8y ago
What is a bug row? Is that a British thing for bug report?
- detaro 8y ago
  a "row" is a loud dispute/fight.
  - chuckgreenman 8y ago
    Thank you! That makes a lot more sense.
- ncallaway 8y ago
  "Row" is british english for "argument", so it would be a bug argument (or disagreement).
- kbsletten 8y ago
  A row is a fight, though it's pronounced in a way I can't seem to type phonetically. But not like row of corn or row the boat.
  - johnr2 8y ago
    > it's pronounced in a way I can't seem to type phonetically. Rhymes with "how".
  - ghusbands 8y ago
    Pronounced like in frown. Or like wow or how or the "low" in flower.
    - logfromblammo 8y ago
      Rhymes with bough, not bow.
      - teddyh 8y ago
SirensOfTitan 8y ago
I don't blame Epic at all for avoiding the Play store. I find it patently unacceptable that two large tech companies now act as gatekeepers for software releases. Sure, it provides extra security, but at a heavy cost. Between Facebook, Google, and Apple the vast majority of the public's digital speech (software and written language) are filtered through large corporations with immense power and few regulations. This feels very, very scary to me. It looks like the Fortnite APK is 1.88GB. I don't have familiarity with the Android platform, can you update via patches (over a full binary download)? If updates are anywhere near that size, a 7 day disclosure after patch is patently irresponsible (play store or not). This smells like a cheap PR play by Google.
- pjmlp 8y ago
  Play Store does incremental updates on the background.
- Dylan16807 8y ago
  The Fortnite Installer APK, the part with the security flaw, seems to be about 4MB? The Fornite APK itself is also <100MB.
- scarface74 8y ago
  I don't blame Epic at all for avoiding the Play store. I find it patently unacceptable that two large tech companies now act as gatekeepers for software releases. More like 5 - Nintendo, Microsoft, and Sony all control what software goes on their platform either digitally through their console app stores or physically since all media has to have keys from the console makers to run. Sure, it provides extra security, but at a heavy cost. Seeing how the last 30+ years of personal computer use has played out, the vast majoriyy of users should probably be using locked down devices. And Epic provided the perfect example of why app developers should be forced into a strict sandbox. I need my phone to always work it’s much easier for me (but not most people) to recover from a virus/malware/ransomware on my computer than a hypothetical one on my phone.
- threatofrain 8y ago
  Why isn't Epic at fault for dishing out insecurity on a platform that contain's a user's everything? If instead it Google wasn't in the picture at all, but an unknown hacker who disclosed vulnerability, would it still make sense to divert blame from Epic? I personally would still blame Epic. Similarly, I also wouldn't care if a random hacker or reputable firm disclosed Target's vulnerabilities when they put millions of customers at risk. I'd blame Target by a big margin.
peterwwillis 8y ago
Just to further underline why Google is a dick here: this is the issue tracking the vuln https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336 Timeline: 8/15/2018: Google reports issue to Epic 8/15/2018: Epic begins investigating 8/15/2018: Epic confirms bug and begins working on fix 8/16/2018: Epic is testing the fix 8/16/2018: Epic begins deploying fix 8/16/2018: Epic asks for full 90-day period to deploy and test the fix 8/24/2018: Google finally replies: "now the patched version of Fortnite Installer has been available for 7 days we will proceed to unrestrict this issue in line with Google's standard disclosure practices" They literally waited until the last minute to go, no, sorry, we're not waiting, it's full-disclosure time, :trollface: Epic noted in the article that the game won't auto-update until the user runs it. So they clearly would have needed to inform users that didn't play regularly to get the update. However, Epic could have notified its own users when they were ready, rather than Google outing them by default. If Google had replied, like, 7 days earlier, and said "sorry we're not waiting", maybe Epic could have made different decisions, knowing they wouldn't get the time they requested. It's clear that Epic worked their asses off to churn out a patch. They could have announced within that time if this was properly coordinated. Whether this was just Google being indifferent to a company's reputation, or an active attempt to penalize Epic for not forking over 30% of their revenue, is left up to the reader. But Google acting in the interest of users is not a defense here, because Google just ignored Epic and then fulldisc'd.
- r3bl 8y ago
  > So they clearly would have needed to inform users that didn't play regularly to get the update. The game came out on August 9th. Knowing how the release was big news, that the game itself is gigantic in size, and only runs on certain higher end smartphones, I would argue that there are close to no Android users that would not enter the game within those seven days.
- mikhailt 8y ago
  No, they didn't wait until the last minute. Read their description, it is the last two lines, they did warn Epic. Here, I'll quote it for you: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.] Google waited a full week after the patch has been made available then they disclosed it.
chubasco 8y ago
It's ironic that Epic is going to accuse anyone of being irresponsible. I got an alert from haveibeenpwned a while back showing that my login credentials from Epic were part of a leak, including my password in plaintext. It wasn't a password that shows up in public password dictionaries.
- nradov 8y ago
  How do you know it wasn't your computer that got compromised?
mediocrejoker 8y ago
It's not too surprising that Google's definition of "patched" is "rolled out to a small percentage of users" since that's essentially how it's worked on Android for years.
mikhailt 8y ago
Just want to make this clear, this is the standard disclosure policy of Google: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.] Note the "or a patch has been made broadly available". 90 days policy almost never apply when there is a patch released. It does not make sense to keep the vuln report hidden when a patch comes out, the act of the patch itself reveals the security issue for anyone who takes the time to check what it does.
- infogulch 8y ago
  This is exactly why epic didn't and shouldn't get the full 90 days -- users that haven't yet updated are more insecure with the patch out than before. The only thing Google should have done better is make it clear to epic that they will lift it in 7 days, not the 90 that they asked for. Epic could have known by looking at other incidents, but based on their request they obviously did not and Google should have corrected them.
forgottenpass 8y ago
Google has effectively mandated everyone implement force-push software updating for all software everywhere, under their 7-day "this is a nice piece of software you've got here, I'd hate to see something bad happen to it" disclosure policy. Google is throwing their weight around to dictate their philosophy on software to the entire industry. It's just good for us that it's debatable whether this particular edict is in everyone's interest, not just google's. Not all that reassuring about Alphabet in general, tho.
RestlessMind 8y ago
Epic is happy to pay Apple a 30% tax, but does not want to do the same for Android? And when Google exposes vulnerabilities in their approach (which was totally predictable), they cry foul? If anything, Google should just make sideloading of apps illegal and let companies like Epic face the legal risks if they try to bypass security for profit motives.
- X6S1x6Okd1st 8y ago
  Don't you need to jailbreak to install a 3rd party app on apple?
  - mr_toad 8y ago
    Either that or a Mac and Xcode. It’s practically impossible for most people.
- kalleboo 8y ago
  They're probably not "happy" to pay Apple 30%, it's just they have no alternative on that platform, whereas on Android sideloading is actually a possibility.
xrd 8y ago
Didn't Epic take this action (releasing without the protections of the play store) directly saying FU to Google? Isn't an act like that going to receive a response like Google did? I'm not questioning the morality of either side. Each action correlates exactly with the response.
fredgrott 8y ago
hmm admitting that a non GooglePLay store android app has a bug...that is an essential duty to ALL ANdroid users whether they use Google pLay Sotre to get apps or not. The dick is Epic not Google

76 points by AndrewDucker 8y ago

> creating an unnecessary risk for Android users in order to score cheap PR points This seems like an accurate take. Why else would google disclose the bug so quickly?

mortehu 8y ago
Because a week had elapsed since the batch became broadly available. Epic is missing a way to push out updates, so they wanted more time.
hs86 8y ago
Google usually gives you 90 days for coordinated disclosure but if you deploy a patch to fix it, the disclosure happens earlier. Epic still requested the full 90 days and Google disagreed: https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336
21 8y ago
To reinforce the idea that the only way to safely get apps on Android is through it's store.
- Piskvorrr 8y ago
  Note that is not the same thing as "get safe apps" - just that the app hasn't been tampered with between the publisher and you. There seems to be a lot of spyware on the Play store still (or whatever it's called this week).
- close04 8y ago
  "Safely". https://venturebeat.com/2018/01/30/google-play-removed-700000-bad-apps-in-2017-70-more-than-in-2016/ https://venturebeat.com/2018/01/30/google-play-removed-70000...
hb3b 8y ago
Google seems in the right here. The disclosure was in line with their policy and I'm sure it made management feel oh so good to burn Fortnite in public for their decision to forego distribution in the Play Store. But here's my personal take. As a consumer I want my phones to run secure apps on secure operating systems. This has a cost obviously which is fair to pass on to developers. It's clear to me, with all the rogue apps and crap in the Play Store that Google is not investing enough in managing app store content. Fortnite won this battle but in my book Apple will win the war.
- justonepost 8y ago
  You mean google? You're right though, Google does a crap job auditing the playstore. It's ludicrous how they'll allow apps get access to everything on the phone without any kind of serious warning to the user. My kids install all sorts of crap. I've warned them that all their texts and photos will end up on the internet because of it. Not highly probable, but certainly possible. Makes for a useful double check they're not texting anything silly.
  - nordsieck 8y ago
    >> It's clear to me, with all the rogue apps and crap in the Play Store that Google is not investing enough in managing app store content. >> >> Fortnite won this battle but in my book Apple will win the war. > You mean google? He's saying that Apple, is doing a much better job of "managing app store content" than Google, and so ultimately it doesn't matter if Fortnite or Apple wins this battle: they're fighting over a mound of rubble while Apple builds a castle.
    - oblio 8y ago
      > they're fighting over a mound of rubble while Apple builds a castle It doesn't matter. Apple doesn't win in the end. In the other Apple vs mound of rubble fight (Windows), Apple lost. Android is doing the same thing. Android 4.0 was Windows 3.1 (first Android version to be "modern", IMO), Android 5.0 was Windows 95 (better UX). Android now just needs Windows XP to be stable enough (I'd argue Android 8.0 was that) and Windows 7 to cover the security aspects (most likely wide spread adoption of new Android permissions). But the writing is kind of on the wall, outside the US Android has majority market share and it's only going up.
vorpalhex 8y ago
Google has very public disclosure deadlines that they followed in this case. The patch was out, Google told people to update. Alternatively, Google could of let users continue running unpatched software until the 90 days expired...

deleted 8y ago

[deleted]

seibelj 8y ago

Aren’t you allowed to use whatever payment service you want inside an Android app, and avoid Google’s in-app payments? Then you avoid the cut to google. Or have I been violating the agreement for years...

steiger 8y ago
You can only do this if the payment is not for digital goods obtained and used in the app. Otherwise, it's a violation of TOS.

cletus 8y ago

Sorry, I'm with Google on this one. Epic chose to go off the reservation (so to speak) and created a giant security hole while doing it. Woops. This part of the article covers this: > Google's disclosure rules state that it reveals details of bugs to the public 90 days after reporting them to the developers responsible if they have not been tackled, but only waits one week after a patch is made "broadly available". So Epic made a patch available and Google waited a week. But: > ... [Time Sweeney] denied suggestions that the tech giant had acted in users' interests by refusing to keep the matter private until mid-November. The 90 days is for unaddressed bugs. This is nothing more than an attempt by Epic to fix bad PR from a security vulnerability they introduced (which arguably at this nascent stage might reduce public confidence in their bypassing the Play Store) by trying to deflect it onto Google. And I get the desire to skip the 30% cut but if you're going to do that you're then responsible for the safety of a person's phone and data. At least be up to the task.

rawrmaan 8y ago

Man, I had to read that headline like 10 times before it made sense. /r/titlegore

arghwhat 8y ago
Same. Quotation marks are important, people!
- jaegerpicker 8y ago
  Totally, I first that was is that even English.
kbsletten 8y ago
I also never use "row" to mean a fight, so I read that as "bug row" (like "skid row", or "cannery row") and couldn't figure out what was even going on.

microcolonel 8y ago

Don't they have an in-app updater? Why does it take more than a week for updates to propagate?

pjmlp 8y ago

I side on Google on this one. Want the profits? Then use them to actually make a safe product.

justonepost 8y ago
7 days seems awfully short and not in the interest of users.
- r3bl 8y ago
  Seven days after the patch, not after disclosure with Epic. Epic patched it on August 17th, Google waited 7 more days (as it is their usual practice) and then they went public. Issue tracker makes more sense than the article IMO: https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336 I guess that usually seven days is more than enough for everyone to update to the latest version available on the Play store, however downloading a giant .apk file within seven days is an inconvenience for most users, which is why Epic requested 90.
  - detaro 8y ago
    Also, Playstore checks for you in the background for updates even if you don't use the app in question, the Fortnite launcher doesn't.
throwaway917100 8y ago
What if I tomorrow figure out a bug in Gmail/adsense and release it public-ally without giving google a chance to fix it. My logic : Want security, stop recording peoples data. ( The most secure way to store data is not store data in the first place) Would that be fair to google and the consumers of google. And I would bet that I would be booked under some "Hacking" related law for doing that.
- joshuamorton 8y ago
  That would be completely different than publishing a bug a week after it was patched.

Someone1234 8y ago

I'd argue that Epic is irresponsible for putting users into this position to start with. All Google did was tell users that they need to update ASAP as they're ALREADY in a compromised position. If there was no update/patch, I might side with Epic, but as soon as the fix was out and everyone needed to update, users needed to know the risks of inaction would inhibit. Not least of all because people may start reverse engineering the patch. Epic has decided this is revenge for them not using Google Play, but if you look at Google's bug efforts historically, this has always been how they handled these issues. They've been highly consistent about it. If Epic wants to keep serious security bugs under wraps in the future, maybe they shouldn't rely on unpaid third parties to audit their code. PS - Google gave them 7 days from patch release, so most auto-updaters likely updated the installer.

justonepost 8y ago
They're both in the wrong. Epic for screwing it up and rushing rather than investing in security, and Google for trying to score PR points at the expense of their users. Google is being anti-secure here by not allowing the update to filter through the ecosystem.
- Someone1234 8y ago
  > Google for trying to score PR points at the expense of their users. Except this is how Google has always handled these bugs. The article even links to other examples involving other companies. > Google is being anti-secure here by not allowing the update to filter through the ecosystem. Or pro-secure here by telling users to urgently update rather than doing nothing and hoping nobody spots the bug and starts exploiting it before users get lucky.
  - zaarn 8y ago
    Well, it's not that there is nothing being done. You're distributing the patch. You don't have to go yelling about the fact you're distributing a highly important security patch, that only draws the attention of the bad guys. Wanting to distribute such patches as low profile is a valid choice and is not "doing nothing and waiting to people to exploit it".

Dwolb 8y ago

The only other thing I’d do here as Fortnite’s Chief is to broadly make secure install infrastructure available to other indie developers. This would gain some goodwill and could turn into another revenue stream. +1 points for turning this issue into more publicity.

Someone1234 8y ago
> make secure install infrastructure available to other indie developers Epic doesn't have "secure" install infrastructure, that's the whole crux of this issue.
- jessaustin 8y ago
  Sure but they are a capable well-capitalized development organization. Such infrastructure is not an impossible technology; numerous open source implementations exist. Therefore they will have such infrastructure sometime in the next 6 months. When they have it, they can offer it as a service to other organizations whose interests are similarly opposed to Google's.
  - Kalium 8y ago
    You're absolutely, completely right! Secure infrastructure is possible and numerous implementations exist. Given how right you are, it's exceptionally odd that a capable well-capitalized development organization would not use such systems and manage such a basic mistake.
    - jessaustin 8y ago
      "Poor decision by management hoping to save some money" is not a rare event.
      - Kalium 8y ago
        For that matter, neither is a poor decision made by engineers who think it's fun to reinvent wheels. Both have happened plenty in history.

chuckgreenman 8y ago

What is a bug row? Is that a British thing for bug report?

detaro 8y ago
a "row" is a loud dispute/fight.
- chuckgreenman 8y ago
  Thank you! That makes a lot more sense.
ncallaway 8y ago
"Row" is british english for "argument", so it would be a bug argument (or disagreement).
kbsletten 8y ago
A row is a fight, though it's pronounced in a way I can't seem to type phonetically. But not like row of corn or row the boat.
- johnr2 8y ago
  > it's pronounced in a way I can't seem to type phonetically. Rhymes with "how".
- ghusbands 8y ago
  Pronounced like in frown. Or like wow or how or the "low" in flower.
  - logfromblammo 8y ago
    Rhymes with bough, not bow.
    - teddyh 8y ago

SirensOfTitan 8y ago

I don't blame Epic at all for avoiding the Play store. I find it patently unacceptable that two large tech companies now act as gatekeepers for software releases. Sure, it provides extra security, but at a heavy cost. Between Facebook, Google, and Apple the vast majority of the public's digital speech (software and written language) are filtered through large corporations with immense power and few regulations. This feels very, very scary to me. It looks like the Fortnite APK is 1.88GB. I don't have familiarity with the Android platform, can you update via patches (over a full binary download)? If updates are anywhere near that size, a 7 day disclosure after patch is patently irresponsible (play store or not). This smells like a cheap PR play by Google.

pjmlp 8y ago
Play Store does incremental updates on the background.
Dylan16807 8y ago
The Fortnite Installer APK, the part with the security flaw, seems to be about 4MB? The Fornite APK itself is also <100MB.
scarface74 8y ago
I don't blame Epic at all for avoiding the Play store. I find it patently unacceptable that two large tech companies now act as gatekeepers for software releases. More like 5 - Nintendo, Microsoft, and Sony all control what software goes on their platform either digitally through their console app stores or physically since all media has to have keys from the console makers to run. Sure, it provides extra security, but at a heavy cost. Seeing how the last 30+ years of personal computer use has played out, the vast majoriyy of users should probably be using locked down devices. And Epic provided the perfect example of why app developers should be forced into a strict sandbox. I need my phone to always work it’s much easier for me (but not most people) to recover from a virus/malware/ransomware on my computer than a hypothetical one on my phone.
threatofrain 8y ago
Why isn't Epic at fault for dishing out insecurity on a platform that contain's a user's everything? If instead it Google wasn't in the picture at all, but an unknown hacker who disclosed vulnerability, would it still make sense to divert blame from Epic? I personally would still blame Epic. Similarly, I also wouldn't care if a random hacker or reputable firm disclosed Target's vulnerabilities when they put millions of customers at risk. I'd blame Target by a big margin.

peterwwillis 8y ago

Just to further underline why Google is a dick here: this is the issue tracking the vuln https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336 Timeline: 8/15/2018: Google reports issue to Epic 8/15/2018: Epic begins investigating 8/15/2018: Epic confirms bug and begins working on fix 8/16/2018: Epic is testing the fix 8/16/2018: Epic begins deploying fix 8/16/2018: Epic asks for full 90-day period to deploy and test the fix 8/24/2018: Google finally replies: "now the patched version of Fortnite Installer has been available for 7 days we will proceed to unrestrict this issue in line with Google's standard disclosure practices" They literally waited until the last minute to go, no, sorry, we're not waiting, it's full-disclosure time, :trollface: Epic noted in the article that the game won't auto-update until the user runs it. So they clearly would have needed to inform users that didn't play regularly to get the update. However, Epic could have notified its own users when they were ready, rather than Google outing them by default. If Google had replied, like, 7 days earlier, and said "sorry we're not waiting", maybe Epic could have made different decisions, knowing they wouldn't get the time they requested. It's clear that Epic worked their asses off to churn out a patch. They could have announced within that time if this was properly coordinated. Whether this was just Google being indifferent to a company's reputation, or an active attempt to penalize Epic for not forking over 30% of their revenue, is left up to the reader. But Google acting in the interest of users is not a defense here, because Google just ignored Epic and then fulldisc'd.

r3bl 8y ago
> So they clearly would have needed to inform users that didn't play regularly to get the update. The game came out on August 9th. Knowing how the release was big news, that the game itself is gigantic in size, and only runs on certain higher end smartphones, I would argue that there are close to no Android users that would not enter the game within those seven days.
mikhailt 8y ago
No, they didn't wait until the last minute. Read their description, it is the last two lines, they did warn Epic. Here, I'll quote it for you: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.] Google waited a full week after the patch has been made available then they disclosed it.

chubasco 8y ago

It's ironic that Epic is going to accuse anyone of being irresponsible. I got an alert from haveibeenpwned a while back showing that my login credentials from Epic were part of a leak, including my password in plaintext. It wasn't a password that shows up in public password dictionaries.

nradov 8y ago
How do you know it wasn't your computer that got compromised?

mediocrejoker 8y ago

It's not too surprising that Google's definition of "patched" is "rolled out to a small percentage of users" since that's essentially how it's worked on Android for years.

mikhailt 8y ago

Just want to make this clear, this is the standard disclosure policy of Google: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.] Note the "or a patch has been made broadly available". 90 days policy almost never apply when there is a patch released. It does not make sense to keep the vuln report hidden when a patch comes out, the act of the patch itself reveals the security issue for anyone who takes the time to check what it does.

infogulch 8y ago
This is exactly why epic didn't and shouldn't get the full 90 days -- users that haven't yet updated are more insecure with the patch out than before. The only thing Google should have done better is make it clear to epic that they will lift it in 7 days, not the 90 that they asked for. Epic could have known by looking at other incidents, but based on their request they obviously did not and Google should have corrected them.

forgottenpass 8y ago

Google has effectively mandated everyone implement force-push software updating for all software everywhere, under their 7-day "this is a nice piece of software you've got here, I'd hate to see something bad happen to it" disclosure policy. Google is throwing their weight around to dictate their philosophy on software to the entire industry. It's just good for us that it's debatable whether this particular edict is in everyone's interest, not just google's. Not all that reassuring about Alphabet in general, tho.

RestlessMind 8y ago

Epic is happy to pay Apple a 30% tax, but does not want to do the same for Android? And when Google exposes vulnerabilities in their approach (which was totally predictable), they cry foul? If anything, Google should just make sideloading of apps illegal and let companies like Epic face the legal risks if they try to bypass security for profit motives.

X6S1x6Okd1st 8y ago
Don't you need to jailbreak to install a 3rd party app on apple?
- mr_toad 8y ago
  Either that or a Mac and Xcode. It’s practically impossible for most people.
kalleboo 8y ago
They're probably not "happy" to pay Apple 30%, it's just they have no alternative on that platform, whereas on Android sideloading is actually a possibility.

xrd 8y ago

Didn't Epic take this action (releasing without the protections of the play store) directly saying FU to Google? Isn't an act like that going to receive a response like Google did? I'm not questioning the morality of either side. Each action correlates exactly with the response.

fredgrott 8y ago

hmm admitting that a non GooglePLay store android app has a bug...that is an essential duty to ALL ANdroid users whether they use Google pLay Sotre to get apps or not. The dick is Epic not Google