4 ms·

What Google did isn't even a scandal. The whole story is "Google fixes security bug". Companies fix bugs all the time without notifying anyone. This is the sill

by darawk 8y ago

What Google did isn't even a scandal. The whole story is "Google fixes security bug". Companies fix bugs all the time without notifying anyone. This is the silliest non-story.

JumpCrisscross 8y ago
> What Google did isn't even a scandal There is a case to be made that tech companies hoarding sensitive data should have heightened disclosure requirements around confirmed and potential breaches. It doesn't have to be a public process. But maybe there should be some process. Regarding "it's just a bug," I personally disagree. A bug that takes down the video player is different from a bug that could expose data. ("Could expose" isn't language we like to use in technology, but the law is fine with such ambiguity.) Analogy: we don't wait for bridges to fail before giving a damn about the cracks. Google et al have never been treated as critical infrastructure. This is a discussion about whether that should change.
- Klathmon 8y ago
  We need to stop using analogies with hardware. Software is fundamentally different and they don't apply in a lot of cases. And in my opinion this is one of them. While I agree that not all bugs are the same level of severity, if there is no evidence of abuse of a bug, and it has been fixed, I see no reason to have them disclose it in any way. It would be akin to forcing companies to disclose when they repremand an employee, or when they change an internal HR process to avoid interpersonal problems.
  - TangoTrotFox 8y ago
    Google is not saying there is no evidence that user information was accessed by third parties. They are claiming that they have no idea and supposedly were not logging access to privileged information. This seems highly questionable. And if this passes for acceptable, it creates a significant incentive for all companies to do away with logging as suddenly they can just claim ignorance on everything.
    - asdfasgasdgasdg 8y ago
      Actually that's exactly what Google has said. Note that this is different from saying there's positive evidence that no user data was accessed. Oh, and are we going to be mad at Google for purging logs now? I thought our hobby horse was Google retaining unneeded logs, but I guess it's even more fun to be mad at them for both so we can be mad no matter what they do.
      - TangoTrotFox 8y ago
        Google is relentless in collecting data on everybody and everything. Until suddenly collecting data could possibly incriminate them in an action, at which point they suddenly claim to lack any data whatsoever. Occam's razor would indicate that Google is being less than truthful.
- asdfasgasdgasdg 8y ago
  There's a case to be made, but it's not a good one. Under the proposal you're making, there would be a non-stop firehose of "potential breach" disclosures from every major company. It would provide zero value to the public, who would quickly become inured to such reports. And it would significantly increase the friction involved in doing business.
  - JumpCrisscross 8y ago
    > the public...would quickly become inured to such reports Who said mandatory public notices? There are lots of options between staying silent and broadcasting every bug.
    - asdfasgasdgasdg 8y ago
      I've seen your response to this effect in another branch of this thread. Your suggestions there seemed pretty half-baked and none of them seemed like they would solve any real extant problem.
corndoge 8y ago
Yes, it's bizarre how the media has siezed on the passive mention of a bug patched in a blog post about Google+ that revealed basically no information of value and turned it into a story. I suppose it's just a reminder how little the media, public and of course the gov't understand this industry. Google certainly thought of it as a non issue or they wouldn't have made it an anecdote...

by darawk 8y ago

What Google did isn't even a scandal. The whole story is "Google fixes security bug". Companies fix bugs all the time without notifying anyone. This is the silliest non-story.

JumpCrisscross 8y ago

> What Google did isn't even a scandal There is a case to be made that tech companies hoarding sensitive data should have heightened disclosure requirements around confirmed and potential breaches. It doesn't have to be a public process. But maybe there should be some process. Regarding "it's just a bug," I personally disagree. A bug that takes down the video player is different from a bug that could expose data. ("Could expose" isn't language we like to use in technology, but the law is fine with such ambiguity.) Analogy: we don't wait for bridges to fail before giving a damn about the cracks. Google et al have never been treated as critical infrastructure. This is a discussion about whether that should change.

Klathmon 8y ago
We need to stop using analogies with hardware. Software is fundamentally different and they don't apply in a lot of cases. And in my opinion this is one of them. While I agree that not all bugs are the same level of severity, if there is no evidence of abuse of a bug, and it has been fixed, I see no reason to have them disclose it in any way. It would be akin to forcing companies to disclose when they repremand an employee, or when they change an internal HR process to avoid interpersonal problems.
- TangoTrotFox 8y ago
  Google is not saying there is no evidence that user information was accessed by third parties. They are claiming that they have no idea and supposedly were not logging access to privileged information. This seems highly questionable. And if this passes for acceptable, it creates a significant incentive for all companies to do away with logging as suddenly they can just claim ignorance on everything.
  - asdfasgasdgasdg 8y ago
    Actually that's exactly what Google has said. Note that this is different from saying there's positive evidence that no user data was accessed. Oh, and are we going to be mad at Google for purging logs now? I thought our hobby horse was Google retaining unneeded logs, but I guess it's even more fun to be mad at them for both so we can be mad no matter what they do.
    - TangoTrotFox 8y ago
      Google is relentless in collecting data on everybody and everything. Until suddenly collecting data could possibly incriminate them in an action, at which point they suddenly claim to lack any data whatsoever. Occam's razor would indicate that Google is being less than truthful.
asdfasgasdgasdg 8y ago
There's a case to be made, but it's not a good one. Under the proposal you're making, there would be a non-stop firehose of "potential breach" disclosures from every major company. It would provide zero value to the public, who would quickly become inured to such reports. And it would significantly increase the friction involved in doing business.
- JumpCrisscross 8y ago
  > the public...would quickly become inured to such reports Who said mandatory public notices? There are lots of options between staying silent and broadcasting every bug.
  - asdfasgasdgasdg 8y ago
    I've seen your response to this effect in another branch of this thread. Your suggestions there seemed pretty half-baked and none of them seemed like they would solve any real extant problem.

corndoge 8y ago

Yes, it's bizarre how the media has siezed on the passive mention of a bug patched in a blog post about Google+ that revealed basically no information of value and turned it into a story. I suppose it's just a reminder how little the media, public and of course the gov't understand this industry. Google certainly thought of it as a non issue or they wouldn't have made it an anecdote...