5 ms·

No, it isn't. Anyone can break apart the patch and figure out what was changed, meaning they can figure out the security issue and take advantage of it. At thi

No, it isn't. Anyone can break apart the patch and figure out what was changed, meaning they can figure out the security issue and take advantage of it. At this point, both Epic and Google are at fault for not disclosing the details and warning people to update right away.

awics 8y ago
There is usually a big difference time and yield in creating exploits from random binary updates and doing the same from disclosures. The amount of people who dissect, or even can dissect, updates are far less than everyone who follows disclosures. So I don't think that argument makes much sense in this scenario.
- mikhailt 8y ago
  Normally I agree but this is Fortnite, massive profits all the time. Just a few hours worth of exploit can gain some a chunk of cash.
peterwwillis 8y ago
Epic is at fault, maybe, for not e-mailing Google every single day asking that they coordinate the announcement better. Google is at fault for not responding for 7 days and then disclosing, and is at fault for having a policy that makes announcing patches dangerous. If you think people should be warned right away, Epic should have the right to notify its own users, and Google should have the basic decency to reply to a request to coordinate.
- mikhailt 8y ago
  Nope, Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. Their 90-day policy is just a courtesy call that comes with an exception, the moment a patch is made available, the disclosure will be made public. Google is not being paid nor asked by Epic to find reports, Epic has no rights to anything. Google found the bug, they have the right to disclose it however they want. There are no legal standards anywhere that requires anyone to do anything with bug reports. Epic doesn't have any rights here, it sucks but they're not entitled to anything. I hate this because I've experienced this from Google before (at work), I would love to have that right to hold up to 90 days before we can notify people but until there are legal standards, there is no right.
  - peterwwillis 8y ago
    > Google is not obligated to reply at all They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. Sure, Epic doesn't have any rights here. But we don't need a law to know people [and corporations] should not be dicks. Google could have been more ethical by replying to the vendor after making their initial communication. They chose not to.
    - r0ll3rb0t 8y ago
      > They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. You are correct in that Google has an ethical obligation; and they and met it by protecting all Android users. I would say that Google making this announcement lets all Android users know that its not safe to just randomly install apps on your phone. Yes, they allow it, but at the same time the public is genuinely ignorant of any type of security practices.
  - antidesitter 8y ago
    > Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. This is a non-sequitur. You are equivocating between legal obligation and ethical obligation.
    - evilDagmar 8y ago
      Their ethical obligation would also be to err towards full disclosure, not away from it. Google's original view of the situation was that installers like this make devices measurably less secure (to which Epic's response was pretty meh), and the installer being exploitable to install pretty much anything only proved that point and then some. ...and frankly, it would not matter who wrote the installer if it got used for a mass infection and attack. Google would still get the bad press and a generous helping of blame because of the trashy way so many "tech reporters" behave to get those mouse clicks.

awics 8y ago

There is usually a big difference time and yield in creating exploits from random binary updates and doing the same from disclosures. The amount of people who dissect, or even can dissect, updates are far less than everyone who follows disclosures. So I don't think that argument makes much sense in this scenario.

mikhailt 8y ago
Normally I agree but this is Fortnite, massive profits all the time. Just a few hours worth of exploit can gain some a chunk of cash.

peterwwillis 8y ago

Epic is at fault, maybe, for not e-mailing Google every single day asking that they coordinate the announcement better. Google is at fault for not responding for 7 days and then disclosing, and is at fault for having a policy that makes announcing patches dangerous. If you think people should be warned right away, Epic should have the right to notify its own users, and Google should have the basic decency to reply to a request to coordinate.

mikhailt 8y ago
Nope, Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. Their 90-day policy is just a courtesy call that comes with an exception, the moment a patch is made available, the disclosure will be made public. Google is not being paid nor asked by Epic to find reports, Epic has no rights to anything. Google found the bug, they have the right to disclose it however they want. There are no legal standards anywhere that requires anyone to do anything with bug reports. Epic doesn't have any rights here, it sucks but they're not entitled to anything. I hate this because I've experienced this from Google before (at work), I would love to have that right to hold up to 90 days before we can notify people but until there are legal standards, there is no right.
- peterwwillis 8y ago
  > Google is not obligated to reply at all They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. Sure, Epic doesn't have any rights here. But we don't need a law to know people [and corporations] should not be dicks. Google could have been more ethical by replying to the vendor after making their initial communication. They chose not to.
  - r0ll3rb0t 8y ago
    > They have an ethical obligation. Security disclosures have major ethical concerns. If you're acting unethically, you are a dick. You are correct in that Google has an ethical obligation; and they and met it by protecting all Android users. I would say that Google making this announcement lets all Android users know that its not safe to just randomly install apps on your phone. Yes, they allow it, but at the same time the public is genuinely ignorant of any type of security practices.
- antidesitter 8y ago
  > Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. This is a non-sequitur. You are equivocating between legal obligation and ethical obligation.
  - evilDagmar 8y ago
    Their ethical obligation would also be to err towards full disclosure, not away from it. Google's original view of the situation was that installers like this make devices measurably less secure (to which Epic's response was pretty meh), and the installer being exploitable to install pretty much anything only proved that point and then some. ...and frankly, it would not matter who wrote the installer if it got used for a mass infection and attack. Google would still get the bad press and a generous helping of blame because of the trashy way so many "tech reporters" behave to get those mouse clicks.