3 ms·

Do Project Zero's blog posts not focus on Google products purposefully, or is that just a perceived bias? I understand and appreciate the work Project Zero doe

by jetpks 8y ago

Do Project Zero's blog posts not focus on Google products purposefully, or is that just a perceived bias? I understand and appreciate the work Project Zero does; it makes us all safer when these bugs are found, and fixed. It just seems like the only project zero blog posts that make the front page are aimed at Microsoft or Apple.

richdougherty 8y ago
Well there's the rather famous Intel issue that got some upvotes. I think they focus on platforms with a lot of users since that has the most benefit.
CJefferson 8y ago
Having done a bunch of fuzzing myself, my guess would be Google is picking up their problems before they get to a release in the main, and most people don't discuss bugs they find in internal testing.
- DannyBee 8y ago
  Actually, project zero does not give google any better treatment than anyone else. (IE Google bugs have the same disclosure rules/timelines/etc)
trash_panda 8y ago
From their first blog post [1]: "We’re not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers" --- [1] https://googleprojectzero.blogspot.com/2014/07/announcing-project-zero.html https://googleprojectzero.blogspot.com/2014/07/announcing-pr...
DannyBee 8y ago
They have published blog posts on google products before (just glancing at that page, you can see there is one about chromeos). You can also see in the dom fuzzing blog post this page links to (https://googleprojectzero.blogspot.com/2017/09/the-great-dom-fuzz-off-of-2017.html https://googleprojectzero.blogspot.com/2017/09/the-great-dom...), that they fuzzed chrome as well and found bugs. But they really just don't publish that many blog posts in the relative scheme of things, relative to the number of issues they find/report. They find and report (publicly) plenty of Google product issues. So i'm not sure you can really draw anything just from the small sample of blog posts they do write.

by jetpks 8y ago

richdougherty 8y ago

Well there's the rather famous Intel issue that got some upvotes. I think they focus on platforms with a lot of users since that has the most benefit.

CJefferson 8y ago

Having done a bunch of fuzzing myself, my guess would be Google is picking up their problems before they get to a release in the main, and most people don't discuss bugs they find in internal testing.

DannyBee 8y ago
Actually, project zero does not give google any better treatment than anyone else. (IE Google bugs have the same disclosure rules/timelines/etc)

trash_panda 8y ago

From their first blog post [1]: "We’re not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers" --- [1] https://googleprojectzero.blogspot.com/2014/07/announcing-project-zero.html https://googleprojectzero.blogspot.com/2014/07/announcing-pr...

DannyBee 8y ago

They have published blog posts on google products before (just glancing at that page, you can see there is one about chromeos). You can also see in the dom fuzzing blog post this page links to (https://googleprojectzero.blogspot.com/2017/09/the-great-dom-fuzz-off-of-2017.html https://googleprojectzero.blogspot.com/2017/09/the-great-dom...), that they fuzzed chrome as well and found bugs. But they really just don't publish that many blog posts in the relative scheme of things, relative to the number of issues they find/report. They find and report (publicly) plenty of Google product issues. So i'm not sure you can really draw anything just from the small sample of blog posts they do write.