7 ms·

US senator urges investigation into Google+ bug ‘coverup’

100 points by egusa 8y ago

deleted 8y ago
[deleted]
garyfirestorm 8y ago
Sure. First hold Equifax accountable, then we'll talk about Google.
- Waterluvian 8y ago
  Half the job of a politician is to get re-elected. This is part of that half. There's outrage and standing up for the people against a big company. Someone will be dragged before Congress and get embarrassed publically. And then we move on.
  - DecayingOrganic 8y ago
    This reminded me of a story: In an op-ed promoting campaign finance reform, the Oracle of Omaha, Warren Buffett, proposed raising the limit on individual contributions from $1,000 to $5,000 and banning all other contributions. No corporate money, no union money, no soft money. It sounds great, except that it would never pass. Campaign finance reform is so hard to pass because the incumbent legislators who have to approve it are the ones who have the most to lose. Their advantage in fundraising is what gives them job security. How do you get people to do something that is against their interest? Put them in what is known as the prisoners’ dilemma. According to Buffett: Well, just suppose some eccentric billionaire (not me, not me!) made the following offer: If the bill was defeated, this person—the E.B.—would donate $1 billion in an allowable manner (soft money makes all possible) to the political party that had delivered the most votes to getting it passed. Given this diabolical application of game theory, the bill would sail through Congress and thus cost our E.B. nothing (establishing him as not so eccentric after all). Consider your options as a Democratic legislator. If you think that the Republicans will support the bill and you work to defeat it, then if you are successful, you will have delivered $1 billion to the Republicans, thereby handing them the resources to dominate for the next decade. Thus there is no gain in opposing the bill if the Republicans are supporting it. Now, if the Republicans are against it and you support it, then you have the chance of making $1 billion. Thus whatever the Republicans do, the Democrats should support the bill. Of course, the same logic applies to the Republicans. They should support the bill no matter what the Democrats do. In the end, both parties support the bill, and our billionaire gets his proposal for free. As a bonus, Buffett notes that the very effectiveness of his plan “would highlight the absurdity of claims that money doesn’t influence Congressional votes.” This situation is called a prisoners’ dilemma because both sides are led to take an action that is against their mutual interest. In the classic version of the prisoners’ dilemma, the police are separately interrogating two suspects. Each is given an incentive to be the first to confess and a much harsher sentence if he holds out while the other confesses. Thus each finds it advantageous to confess, though they would both do better if each kept quiet. From the book The Art of Strategy. Great book.
    - Waterluvian 8y ago
      Wow. That sounds both brilliant and diabolical. But what stops politicians from flipping the switch again? Just that they have large coffers? Somehow I'm not convinced any amount of money would satisfy them.
    - JumpCrisscross 8y ago
      > How do you get people to do something that is against their interest? You remove them from the system. This is why we have a process through which the states can amend the Constitution.
    - rasteau 8y ago
      The prisoner's dilemma hinges on lack of communication between the prisoners. In the original scenario, communicating prisoners would both choose to stay silent. In the above scenario, communicating politicians would choose to never let the bill out of committee.
      - JumpCrisscross 8y ago
        > communicating politicians would choose to never let the bill out of committee This presumes every politician is equally dependent on outside financing. Self-financed and small-donation financed politicians would be politically incentivized to bunch together and knock the legs out from under the competition's money machine. Politics is complicated. Condemning campaign finance reform is premature. (Saying it's a tough fight would be accurate.)
    - deleted 8y ago
      [deleted]
  - paulcole 8y ago
    The only job of a politician is to get elected.
  - JumpCrisscross 8y ago
    > This is part of that half The other half, selling proposed legislation to one's own (and one's colleagues') constituents, involves the same process.
  - HillaryBriss 8y ago
    whether rightly or wrongly, this is an East Coast Democrat taking a swipe at one of California's most important tax revenue sources. but California is the Democratic Party's heartland. i'm not trying to make a political statement here, just an observation that the Democratic party is of two minds when it comes to tech nowadays. it didn't used to be this way. further evidence of an emerging political realignment.
    - Waterluvian 8y ago
      May also be evidence of the problem of only having two parties. Surely there's many valid left wing positions worthy of sparring in the political arena.
- JumpCrisscross 8y ago
  > First hold Equifax accountable, then we'll talk about Google They're both screw-ups. If someone breaks into your house, we don't say "first let's solve peace in the Middle East; then we'll talk about your house." Something being second (or further down the list) doesn't mean it should be ignored. It's just another reason to look at the issue. Google is more politically vulnerable than Equifax because more people know what it is. That makes it a better whipping boy for getting public support behind any resulting legislation.
  - darawk 8y ago
    What Google did isn't even a scandal. The whole story is "Google fixes security bug". Companies fix bugs all the time without notifying anyone. This is the silliest non-story.
    - JumpCrisscross 8y ago
      > What Google did isn't even a scandal There is a case to be made that tech companies hoarding sensitive data should have heightened disclosure requirements around confirmed and potential breaches. It doesn't have to be a public process. But maybe there should be some process. Regarding "it's just a bug," I personally disagree. A bug that takes down the video player is different from a bug that could expose data. ("Could expose" isn't language we like to use in technology, but the law is fine with such ambiguity.) Analogy: we don't wait for bridges to fail before giving a damn about the cracks. Google et al have never been treated as critical infrastructure. This is a discussion about whether that should change.
      - Klathmon 8y ago
        We need to stop using analogies with hardware. Software is fundamentally different and they don't apply in a lot of cases. And in my opinion this is one of them. While I agree that not all bugs are the same level of severity, if there is no evidence of abuse of a bug, and it has been fixed, I see no reason to have them disclose it in any way. It would be akin to forcing companies to disclose when they repremand an employee, or when they change an internal HR process to avoid interpersonal problems.
- mothers 8y ago
  Please stop. Whataboutism is not helpful.
- UncleEntity 8y ago
  > Sure. First hold Equifax accountable, then we'll talk about Google. Nah, first hold OPM accountable then we'll talk about the private sector.
knorker 8y ago
So not only should companies have to publish hacks, they also have to publish when they internally find a bug? Do I also need to publish if I left my keys in the door for two hours, but nobody broke in?
- jstanley 8y ago
  How do you know nobody broke in? And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised.
  - orev 8y ago
    Server logs are more or less equivalent the video recordings of the front door in this analogy. So the answer is you can know that nobody broke in by looking at the logs/recordings.
    - dgellow 8y ago
      Google explicitly said in their post that they don’t have more than two weeks of logs (ironically, for privacy reasons).
  - knorker 8y ago
    > How do you know nobody broke in? This applies to almost every security-related bug ever, so the analogy holds. If you run a company with PII in your mysql, and mysql has a bug (not uncommon), are you now required to tell all your customers that someone may have hacked your database, and then erased the logs? What if you irresponsibly didn't have a firewall (or your firewall allowed connections from business partners, to some non-PII tables)? It's possible that between the time the bug was introduced (or made public), and the time you patched, that someone at your business partner stole personal information, and it's not feasible for you to in all cases know if this happened. No matter how good you are, it's not feasible in the real world. > And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised. Maybe I should. And in this case, I did. But not right away. But it's a long way from "maybe you should" to "you MUST (by power of law) IMMEDIATELY". Read up on some "keys left in the door" scenarios about nuclear weapons security. We tend to not find out about those right away either.
tptacek 8y ago
What an embarrassment. Blumenthal should leave the performative infosec policymaking to his colleague Ron Wyden. It is not and never has been a norm for SAAS vendors to disclose internal vulnerabilities that have not been discovered independently by third parties. Tens of thousands are found every year by internal teams and contractors at companies around the country, many of them far more severe than the G+ bug (which would probably win a sev:low on a real assessment, less impactful than an XSS bug). You hear about none of them. A coherent argument that this is as it should be: http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-boring.html http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-... You can argue that things should be different for shrink-wrap software and hardware products, where vulnerabilities have a half-life and users need to be notified to patch. I won't disagree, but I will note that the norm of not disclosing internal discoveries holds there as well.
- JumpCrisscross 8y ago
  > Tens of thousands are found every year by internal teams and contractors at companies around the country It's fair to say "Google followed current best practice." It's not fair to say "current practice is how it should always be." What is acceptable for a company selling razors to Minessotans may not be for a behemoth with troves of personal data on every American. The question, "should Google have heightened disclosure requirements around confirmed and potential breaches," is not invalid.
  - tptacek 8y ago
    The link I posted does a better job of directly addressing that argument than I could do by retyping it here.
    - JumpCrisscross 8y ago
      > The link I posted does a better job of directly addressing that argument than I could do by retyping it here An argument that wouldn't have been made if we weren't having this discussion. I'm not saying Google messed up. I'm simply defending the debate.
Isinlor 8y ago
It's a really shitty job by Google PR people. Who in their right mind would close product in response to a security vulnerability? It was bound to grow out of proportions. Headlines like "500 000 people at risk! The bug was so serious that Google shuts down their social network!" just write themselves.

100 points by egusa 8y ago

deleted 8y ago

[deleted]

garyfirestorm 8y ago

Sure. First hold Equifax accountable, then we'll talk about Google.

Waterluvian 8y ago
Half the job of a politician is to get re-elected. This is part of that half. There's outrage and standing up for the people against a big company. Someone will be dragged before Congress and get embarrassed publically. And then we move on.
- DecayingOrganic 8y ago
  This reminded me of a story: In an op-ed promoting campaign finance reform, the Oracle of Omaha, Warren Buffett, proposed raising the limit on individual contributions from $1,000 to $5,000 and banning all other contributions. No corporate money, no union money, no soft money. It sounds great, except that it would never pass. Campaign finance reform is so hard to pass because the incumbent legislators who have to approve it are the ones who have the most to lose. Their advantage in fundraising is what gives them job security. How do you get people to do something that is against their interest? Put them in what is known as the prisoners’ dilemma. According to Buffett: Well, just suppose some eccentric billionaire (not me, not me!) made the following offer: If the bill was defeated, this person—the E.B.—would donate $1 billion in an allowable manner (soft money makes all possible) to the political party that had delivered the most votes to getting it passed. Given this diabolical application of game theory, the bill would sail through Congress and thus cost our E.B. nothing (establishing him as not so eccentric after all). Consider your options as a Democratic legislator. If you think that the Republicans will support the bill and you work to defeat it, then if you are successful, you will have delivered $1 billion to the Republicans, thereby handing them the resources to dominate for the next decade. Thus there is no gain in opposing the bill if the Republicans are supporting it. Now, if the Republicans are against it and you support it, then you have the chance of making $1 billion. Thus whatever the Republicans do, the Democrats should support the bill. Of course, the same logic applies to the Republicans. They should support the bill no matter what the Democrats do. In the end, both parties support the bill, and our billionaire gets his proposal for free. As a bonus, Buffett notes that the very effectiveness of his plan “would highlight the absurdity of claims that money doesn’t influence Congressional votes.” This situation is called a prisoners’ dilemma because both sides are led to take an action that is against their mutual interest. In the classic version of the prisoners’ dilemma, the police are separately interrogating two suspects. Each is given an incentive to be the first to confess and a much harsher sentence if he holds out while the other confesses. Thus each finds it advantageous to confess, though they would both do better if each kept quiet. From the book The Art of Strategy. Great book.
  - Waterluvian 8y ago
    Wow. That sounds both brilliant and diabolical. But what stops politicians from flipping the switch again? Just that they have large coffers? Somehow I'm not convinced any amount of money would satisfy them.
  - JumpCrisscross 8y ago
    > How do you get people to do something that is against their interest? You remove them from the system. This is why we have a process through which the states can amend the Constitution.
  - rasteau 8y ago
    The prisoner's dilemma hinges on lack of communication between the prisoners. In the original scenario, communicating prisoners would both choose to stay silent. In the above scenario, communicating politicians would choose to never let the bill out of committee.
    - JumpCrisscross 8y ago
      > communicating politicians would choose to never let the bill out of committee This presumes every politician is equally dependent on outside financing. Self-financed and small-donation financed politicians would be politically incentivized to bunch together and knock the legs out from under the competition's money machine. Politics is complicated. Condemning campaign finance reform is premature. (Saying it's a tough fight would be accurate.)
  - deleted 8y ago
    [deleted]
- paulcole 8y ago
  The only job of a politician is to get elected.
- JumpCrisscross 8y ago
  > This is part of that half The other half, selling proposed legislation to one's own (and one's colleagues') constituents, involves the same process.
- HillaryBriss 8y ago
  whether rightly or wrongly, this is an East Coast Democrat taking a swipe at one of California's most important tax revenue sources. but California is the Democratic Party's heartland. i'm not trying to make a political statement here, just an observation that the Democratic party is of two minds when it comes to tech nowadays. it didn't used to be this way. further evidence of an emerging political realignment.
  - Waterluvian 8y ago
    May also be evidence of the problem of only having two parties. Surely there's many valid left wing positions worthy of sparring in the political arena.
JumpCrisscross 8y ago
> First hold Equifax accountable, then we'll talk about Google They're both screw-ups. If someone breaks into your house, we don't say "first let's solve peace in the Middle East; then we'll talk about your house." Something being second (or further down the list) doesn't mean it should be ignored. It's just another reason to look at the issue. Google is more politically vulnerable than Equifax because more people know what it is. That makes it a better whipping boy for getting public support behind any resulting legislation.
- darawk 8y ago
  What Google did isn't even a scandal. The whole story is "Google fixes security bug". Companies fix bugs all the time without notifying anyone. This is the silliest non-story.
  - JumpCrisscross 8y ago
    > What Google did isn't even a scandal There is a case to be made that tech companies hoarding sensitive data should have heightened disclosure requirements around confirmed and potential breaches. It doesn't have to be a public process. But maybe there should be some process. Regarding "it's just a bug," I personally disagree. A bug that takes down the video player is different from a bug that could expose data. ("Could expose" isn't language we like to use in technology, but the law is fine with such ambiguity.) Analogy: we don't wait for bridges to fail before giving a damn about the cracks. Google et al have never been treated as critical infrastructure. This is a discussion about whether that should change.
    - Klathmon 8y ago
      We need to stop using analogies with hardware. Software is fundamentally different and they don't apply in a lot of cases. And in my opinion this is one of them. While I agree that not all bugs are the same level of severity, if there is no evidence of abuse of a bug, and it has been fixed, I see no reason to have them disclose it in any way. It would be akin to forcing companies to disclose when they repremand an employee, or when they change an internal HR process to avoid interpersonal problems.
mothers 8y ago
Please stop. Whataboutism is not helpful.
UncleEntity 8y ago
> Sure. First hold Equifax accountable, then we'll talk about Google. Nah, first hold OPM accountable then we'll talk about the private sector.

knorker 8y ago

So not only should companies have to publish hacks, they also have to publish when they internally find a bug? Do I also need to publish if I left my keys in the door for two hours, but nobody broke in?

jstanley 8y ago
How do you know nobody broke in? And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised.
- orev 8y ago
  Server logs are more or less equivalent the video recordings of the front door in this analogy. So the answer is you can know that nobody broke in by looking at the logs/recordings.
  - dgellow 8y ago
    Google explicitly said in their post that they don’t have more than two weeks of logs (ironically, for privacy reasons).
- knorker 8y ago
  > How do you know nobody broke in? This applies to almost every security-related bug ever, so the analogy holds. If you run a company with PII in your mysql, and mysql has a bug (not uncommon), are you now required to tell all your customers that someone may have hacked your database, and then erased the logs? What if you irresponsibly didn't have a firewall (or your firewall allowed connections from business partners, to some non-PII tables)? It's possible that between the time the bug was introduced (or made public), and the time you patched, that someone at your business partner stole personal information, and it's not feasible for you to in all cases know if this happened. No matter how good you are, it's not feasible in the real world. > And if you're responsible for storing personal data for millions of people in your home, and you left the keys in the door for a few hours, and you can't prove that nobody broke in, then maybe you should let people know that there's a chance their data has been compromised. Maybe I should. And in this case, I did. But not right away. But it's a long way from "maybe you should" to "you MUST (by power of law) IMMEDIATELY". Read up on some "keys left in the door" scenarios about nuclear weapons security. We tend to not find out about those right away either.

tptacek 8y ago

What an embarrassment. Blumenthal should leave the performative infosec policymaking to his colleague Ron Wyden. It is not and never has been a norm for SAAS vendors to disclose internal vulnerabilities that have not been discovered independently by third parties. Tens of thousands are found every year by internal teams and contractors at companies around the country, many of them far more severe than the G+ bug (which would probably win a sev:low on a real assessment, less impactful than an XSS bug). You hear about none of them. A coherent argument that this is as it should be: http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-boring.html http://flaked.sockpuppet.org/2018/10/09/internal-disclosure-... You can argue that things should be different for shrink-wrap software and hardware products, where vulnerabilities have a half-life and users need to be notified to patch. I won't disagree, but I will note that the norm of not disclosing internal discoveries holds there as well.

JumpCrisscross 8y ago
> Tens of thousands are found every year by internal teams and contractors at companies around the country It's fair to say "Google followed current best practice." It's not fair to say "current practice is how it should always be." What is acceptable for a company selling razors to Minessotans may not be for a behemoth with troves of personal data on every American. The question, "should Google have heightened disclosure requirements around confirmed and potential breaches," is not invalid.
- tptacek 8y ago
  The link I posted does a better job of directly addressing that argument than I could do by retyping it here.
  - JumpCrisscross 8y ago
    > The link I posted does a better job of directly addressing that argument than I could do by retyping it here An argument that wouldn't have been made if we weren't having this discussion. I'm not saying Google messed up. I'm simply defending the debate.

Isinlor 8y ago

It's a really shitty job by Google PR people. Who in their right mind would close product in response to a security vulnerability? It was bound to grow out of proportions. Headlines like "500 000 people at risk! The bug was so serious that Google shuts down their social network!" just write themselves.