3 ms·
This seems to be why Epic asked for Google to extend the period to 90 days, which didn't seem too unreasonable. Ignoring this request only to reply just before
by contravariant 8y ago
This seems to be why Epic asked for Google to extend the period to 90 days, which didn't seem too unreasonable. Ignoring this request only to reply just before disclosing the vulnerability seems rather careless.
- PeterisP 8y agoThe policy prescribes no more than 90 days between informing about the vulnerability and releasing the patch and/or information, however, it prescribes 0 days between releasing the patch and disclosure. If Epic needed more time to prepare for deploying the patch, then they should have released the patch later, coordinating with Google - they certainly had time left for that, up to these 90 days. But once Epic started the clock by making the patch widely available, it is unreasonable to wait anything comparable to 90 days. Google should have disclosed the vulnerability on the same day as the patch, since the patch also 'discloses' the vulnerability to those who would use it. Delaying it for a day or two could be mostly safe; 7 days is pushing it, anything more than that is not a good idea - by that time the bad guys know the vulnerability anyway, and the delay is just harming everyone else.
- contravariant 8y agoI still see no reason this couldn't have been communicated to Epic, nor why Google felt the need to take it upon themselves to decide. Whatever happens now can no longer be considered to be Epic's fault, as other than existence of the bug itself their response to the report has been close to perfect and Google overruled them on anything else.
- joshuamorton 8y agoGoogle did communicate this, in the initial post where the bug was filed and disclosed to epic. (I work for Google).
- X6S1x6Okd1st 8y agoAnnouncing something doesn't make it ethical.