5 ms·
Just to further underline why Google is a dick here: this is the issue tracking the vuln https://issuetracker.google.com/issues/112630336 https://issuetracker.g
by peterwwillis 8y ago
Just to further underline why Google is a dick here: this is the issue tracking the vuln https://issuetracker.google.com/issues/112630336 https://issuetracker.google.com/issues/112630336
Timeline:
8/15/2018: Google reports issue to Epic
8/15/2018: Epic begins investigating
8/15/2018: Epic confirms bug and begins working on fix
8/16/2018: Epic is testing the fix
8/16/2018: Epic begins deploying fix
8/16/2018: Epic asks for full 90-day period to deploy and test the fix
8/24/2018: Google finally replies: "now the patched version of Fortnite Installer has been available for 7 days we will proceed to unrestrict this issue in line with Google's standard disclosure practices"
They literally waited until the last minute to go, no, sorry, we're not waiting, it's full-disclosure time, :trollface:
Epic noted in the article that the game won't auto-update until the user runs it. So they clearly would have needed to inform users that didn't play regularly to get the update. However, Epic could have notified its own users when they were ready, rather than Google outing them by default.
If Google had replied, like, 7 days earlier, and said "sorry we're not waiting", maybe Epic could have made different decisions, knowing they wouldn't get the time they requested. It's clear that Epic worked their asses off to churn out a patch. They could have announced within that time if this was properly coordinated.
Whether this was just Google being indifferent to a company's reputation, or an active attempt to penalize Epic for not forking over 30% of their revenue, is left up to the reader. But Google acting in the interest of users is not a defense here, because Google just ignored Epic and then fulldisc'd.
- r3bl 8y ago> So they clearly would have needed to inform users that didn't play regularly to get the update. The game came out on August 9th. Knowing how the release was big news, that the game itself is gigantic in size, and only runs on certain higher end smartphones, I would argue that there are close to no Android users that would not enter the game within those seven days.
- mikhailt 8y agoNo, they didn't wait until the last minute. Read their description, it is the last two lines, they did warn Epic. Here, I'll quote it for you: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.] Google waited a full week after the patch has been made available then they disclosed it.
- peterwwillis 8y ago"After 90 days elapse or a patch has been made broadly available" This incentivizes companies not to announce their patches, not to coordinate with Google, and to only update in secret, because as soon as they tell Google they have a patch, the clock runs down in 7 days, rather than 90. This is a dangerous policy.
- mikhailt 8y agoNo, it isn't. Anyone can break apart the patch and figure out what was changed, meaning they can figure out the security issue and take advantage of it. At this point, both Epic and Google are at fault for not disclosing the details and warning people to update right away.
- awics 8y agoThere is usually a big difference time and yield in creating exploits from random binary updates and doing the same from disclosures. The amount of people who dissect, or even can dissect, updates are far less than everyone who follows disclosures. So I don't think that argument makes much sense in this scenario.
- mikhailt 8y agoNormally I agree but this is Fortnite, massive profits all the time. Just a few hours worth of exploit can gain some a chunk of cash.
- peterwwillis 8y agoEpic is at fault, maybe, for not e-mailing Google every single day asking that they coordinate the announcement better. Google is at fault for not responding for 7 days and then disclosing, and is at fault for having a policy that makes announcing patches dangerous. If you think people should be warned right away, Epic should have the right to notify its own users, and Google should have the basic decency to reply to a request to coordinate.
- noicebrewery 8y agoNo, Epic is at fault for having a basic bug that is incredibly easy to exploit. At what point did people who browse a site called "Hacker News" start believing in Security through Obscurity?
- deleted 8y ago[deleted]