4 ms·

No, they didn't wait until the last minute. Read their description, it is the last two lines, they did warn Epic. Here, I'll quote it for you: > [NOTE: This b

No, they didn't wait until the last minute. Read their description, it is the last two lines, they did warn Epic. Here, I'll quote it for you: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.] Google waited a full week after the patch has been made available then they disclosed it.

peterwwillis 8y ago
"After 90 days elapse or a patch has been made broadly available" This incentivizes companies not to announce their patches, not to coordinate with Google, and to only update in secret, because as soon as they tell Google they have a patch, the clock runs down in 7 days, rather than 90. This is a dangerous policy.
- mikhailt 8y ago
  No, it isn't. Anyone can break apart the patch and figure out what was changed, meaning they can figure out the security issue and take advantage of it. At this point, both Epic and Google are at fault for not disclosing the details and warning people to update right away.
  - awics 8y ago
    There is usually a big difference time and yield in creating exploits from random binary updates and doing the same from disclosures. The amount of people who dissect, or even can dissect, updates are far less than everyone who follows disclosures. So I don't think that argument makes much sense in this scenario.
    - mikhailt 8y ago
      Normally I agree but this is Fortnite, massive profits all the time. Just a few hours worth of exploit can gain some a chunk of cash.
  - peterwwillis 8y ago
    Epic is at fault, maybe, for not e-mailing Google every single day asking that they coordinate the announcement better. Google is at fault for not responding for 7 days and then disclosing, and is at fault for having a policy that makes announcing patches dangerous. If you think people should be warned right away, Epic should have the right to notify its own users, and Google should have the basic decency to reply to a request to coordinate.
    - mikhailt 8y ago
      Nope, Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. Their 90-day policy is just a courtesy call that comes with an exception, the moment a patch is made available, the disclosure will be made public. Google is not being paid nor asked by Epic to find reports, Epic has no rights to anything. Google found the bug, they have the right to disclose it however they want. There are no legal standards anywhere that requires anyone to do anything with bug reports. Epic doesn't have any rights here, it sucks but they're not entitled to anything. I hate this because I've experienced this from Google before (at work), I would love to have that right to hold up to 90 days before we can notify people but until there are legal standards, there is no right.
      - peterwwillis 8y ago
        > Google is not obligated to reply at all They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. Sure, Epic doesn't have any rights here. But we don't need a law to know people [and corporations] should not be dicks. Google could have been more ethical by replying to the vendor after making their initial communication. They chose not to.
        r0ll3rb0t 8y ago
        > They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. You are correct in that Google has an ethical obligation; and they and met it by protecting all Android users. I would say that Google making this announcement lets all Android users know that its not safe to just randomly install apps on your phone. Yes, they allow it, but at the same time the public is genuinely ignorant of any type of security practices.
- Someone1234 8y ago
  Google independently discovered the issue, Google can therefore independently verify if a patch has fixed it with or without Epic's information.
- PeterisP 8y ago
  No, look at "broadly available" part of the sentence you quoted. It would be reasonable to tell Google that they have a patch, show them the patch, and tell that's going to be released on third thursday of September or whatever, and the disclosure should wait until that - that's compatible with that policy. Showing the patch to Google and coordinating with them doesn't start the clock, the clock starts when you start sending the patch to random users. It's not acceptable to release a patch to the general public and then delay the disclosure for weeks. Once Epic discloses the vulnerability to the bad guys (by making the patch broadly available), the good guys i.e. the general public needs to know the details ASAP. The 90 day buffer is the time for analyzing the vulnerability and developing (and testing) a fix for it - but not for deploying the fix; deployment must be much, much faster than that, preferably on a single day.
  - paulddraper 8y ago
    That doesn't really change the incentive though. I guarantee Fortnite wishes they had silently released the patch and hope Google didn't know. I'm guessing they might in the future.
contravariant 8y ago
This seems to be why Epic asked for Google to extend the period to 90 days, which didn't seem too unreasonable. Ignoring this request only to reply just before disclosing the vulnerability seems rather careless.
- PeterisP 8y ago
  The policy prescribes no more than 90 days between informing about the vulnerability and releasing the patch and/or information, however, it prescribes 0 days between releasing the patch and disclosure. If Epic needed more time to prepare for deploying the patch, then they should have released the patch later, coordinating with Google - they certainly had time left for that, up to these 90 days. But once Epic started the clock by making the patch widely available, it is unreasonable to wait anything comparable to 90 days. Google should have disclosed the vulnerability on the same day as the patch, since the patch also 'discloses' the vulnerability to those who would use it. Delaying it for a day or two could be mostly safe; 7 days is pushing it, anything more than that is not a good idea - by that time the bad guys know the vulnerability anyway, and the delay is just harming everyone else.
  - contravariant 8y ago
    I still see no reason this couldn't have been communicated to Epic, nor why Google felt the need to take it upon themselves to decide. Whatever happens now can no longer be considered to be Epic's fault, as other than existence of the bug itself their response to the report has been close to perfect and Google overruled them on anything else.
    - joshuamorton 8y ago
      Google did communicate this, in the initial post where the bug was filed and disclosed to epic. (I work for Google).
  - X6S1x6Okd1st 8y ago
    Announcing something doesn't make it ethical.
fierro 8y ago
this is so often the case with comments about Google here on HN; someone vilifies them, then another commenter explains what really went down. The people at Google are not evil or malicious, lol

peterwwillis 8y ago

"After 90 days elapse or a patch has been made broadly available" This incentivizes companies not to announce their patches, not to coordinate with Google, and to only update in secret, because as soon as they tell Google they have a patch, the clock runs down in 7 days, rather than 90. This is a dangerous policy.

mikhailt 8y ago
No, it isn't. Anyone can break apart the patch and figure out what was changed, meaning they can figure out the security issue and take advantage of it. At this point, both Epic and Google are at fault for not disclosing the details and warning people to update right away.
- awics 8y ago
  There is usually a big difference time and yield in creating exploits from random binary updates and doing the same from disclosures. The amount of people who dissect, or even can dissect, updates are far less than everyone who follows disclosures. So I don't think that argument makes much sense in this scenario.
  - mikhailt 8y ago
    Normally I agree but this is Fortnite, massive profits all the time. Just a few hours worth of exploit can gain some a chunk of cash.
- peterwwillis 8y ago
  Epic is at fault, maybe, for not e-mailing Google every single day asking that they coordinate the announcement better. Google is at fault for not responding for 7 days and then disclosing, and is at fault for having a policy that makes announcing patches dangerous. If you think people should be warned right away, Epic should have the right to notify its own users, and Google should have the basic decency to reply to a request to coordinate.
  - mikhailt 8y ago
    Nope, Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. Their 90-day policy is just a courtesy call that comes with an exception, the moment a patch is made available, the disclosure will be made public. Google is not being paid nor asked by Epic to find reports, Epic has no rights to anything. Google found the bug, they have the right to disclose it however they want. There are no legal standards anywhere that requires anyone to do anything with bug reports. Epic doesn't have any rights here, it sucks but they're not entitled to anything. I hate this because I've experienced this from Google before (at work), I would love to have that right to hold up to 90 days before we can notify people but until there are legal standards, there is no right.
    - peterwwillis 8y ago
      > Google is not obligated to reply at all They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. Sure, Epic doesn't have any rights here. But we don't need a law to know people [and corporations] should not be dicks. Google could have been more ethical by replying to the vendor after making their initial communication. They chose not to.
      - r0ll3rb0t 8y ago
        > They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. You are correct in that Google has an ethical obligation; and they and met it by protecting all Android users. I would say that Google making this announcement lets all Android users know that its not safe to just randomly install apps on your phone. Yes, they allow it, but at the same time the public is genuinely ignorant of any type of security practices.
Someone1234 8y ago
Google independently discovered the issue, Google can therefore independently verify if a patch has fixed it with or without Epic's information.
PeterisP 8y ago
No, look at "broadly available" part of the sentence you quoted. It would be reasonable to tell Google that they have a patch, show them the patch, and tell that's going to be released on third thursday of September or whatever, and the disclosure should wait until that - that's compatible with that policy. Showing the patch to Google and coordinating with them doesn't start the clock, the clock starts when you start sending the patch to random users. It's not acceptable to release a patch to the general public and then delay the disclosure for weeks. Once Epic discloses the vulnerability to the bad guys (by making the patch broadly available), the good guys i.e. the general public needs to know the details ASAP. The 90 day buffer is the time for analyzing the vulnerability and developing (and testing) a fix for it - but not for deploying the fix; deployment must be much, much faster than that, preferably on a single day.
- paulddraper 8y ago
  That doesn't really change the incentive though. I guarantee Fortnite wishes they had silently released the patch and hope Google didn't know. I'm guessing they might in the future.

contravariant 8y ago

This seems to be why Epic asked for Google to extend the period to 90 days, which didn't seem too unreasonable. Ignoring this request only to reply just before disclosing the vulnerability seems rather careless.

PeterisP 8y ago
The policy prescribes no more than 90 days between informing about the vulnerability and releasing the patch and/or information, however, it prescribes 0 days between releasing the patch and disclosure. If Epic needed more time to prepare for deploying the patch, then they should have released the patch later, coordinating with Google - they certainly had time left for that, up to these 90 days. But once Epic started the clock by making the patch widely available, it is unreasonable to wait anything comparable to 90 days. Google should have disclosed the vulnerability on the same day as the patch, since the patch also 'discloses' the vulnerability to those who would use it. Delaying it for a day or two could be mostly safe; 7 days is pushing it, anything more than that is not a good idea - by that time the bad guys know the vulnerability anyway, and the delay is just harming everyone else.
- contravariant 8y ago
  I still see no reason this couldn't have been communicated to Epic, nor why Google felt the need to take it upon themselves to decide. Whatever happens now can no longer be considered to be Epic's fault, as other than existence of the bug itself their response to the report has been close to perfect and Google overruled them on anything else.
  - joshuamorton 8y ago
    Google did communicate this, in the initial post where the bug was filed and disclosed to epic. (I work for Google).
- X6S1x6Okd1st 8y ago
  Announcing something doesn't make it ethical.

fierro 8y ago

this is so often the case with comments about Google here on HN; someone vilifies them, then another commenter explains what really went down. The people at Google are not evil or malicious, lol