6 ms·

I hold the unpopular opinion that Google Project Zero is pretentious and unprofessional. I mean here we have the most valuable company on Earth, specifically s

I hold the unpopular opinion that Google Project Zero is pretentious and unprofessional. I mean here we have the most valuable company on Earth, specifically scoping out competing software and hardware constantly looking for zero day vulnerabilities. They don't submit to the bug bounty, so if they have a disclosure that you disagree with you better agree quick because they'll just go public. How fast do you think I would get sued if I found a zero day in a Google product, told Google to fix it, shove the bounty, and then went public 30 days later?

jayd16 8y ago
Has this ever happened with Google or is it pure speculation?
jasonvorhe 8y ago
They're using iPhones themselves inside of the company, trusting the devices as part of their Beyond Corp security mechanism, so they have an interest in the software trusted to their company network being as secure as possible.
- 6d6b73 8y ago
  And we don't? I want my phone to be as secure as possible because I use it for work, but of course, since it's not brand new I can't get updates.
  - WrtCdEvrydy 8y ago
    That's a symptom of cybersecurity. If a law made a security bug a refundable or warrantied defect, I bet you this shit would stop. But noone gives a shit.
    - hnnh44 8y ago
      It would also seriously stymie innovation. If I risk having to refund an item when I push out improvements, I'm never bothering to push out improvements except bug fixes. I'm also incentivized to release a new model every month with ANY improvement in order to limit my liability to a smaller window of revenue. The current system isn't perfect, but it could be much worse.
      - WrtCdEvrydy 8y ago
        What's worse that thousands of pieces of throwaway hardware that don't get updates? How about thousands of enterprise systems where the security updates are hidden behind support contacts? > when I push out improvements No, if your software has a security issue, it's refundable. Write good software. > release a new model every month with ANY improvement Good, but that doesn't remove your liability from your last model.
        joshuamorton 8y ago
        >No, if your software has a security issue, it's refundable. Write good software. There are 0 companies that can provide consumer software on the lifecycle consumers have come to expect without any bugs. You write software. Are you willing to claim that you can just "write good software" and never ship anything with a security issues? Because otherwise you're advocating for consumer tools that use nasa's release cycle. Which like, that's cool and all but I don't want to rely on hardware from 2012 or 2005 running software that was developed from 2010-2014 and has just finished its verification process. You're advocating for a world where we just got the verifiably bug-free Nokia 3310. And that doesn't even begin to discuss the clusterfuck that would be open-source in this situation. Am I liable for heartbleed because I use OpenSSL? Are the openSSL devs?
        WrtCdEvrydy 8y ago
        Same bullshit argument was made about GDPR and we survived that... there's just too much money to be made by outsourcing your shitty code's security bugs onto the customer.
        joshuamorton 8y ago
        Those aren't the same though. GDPR is basically "you are liable if you are actively exploited and data is stolen". You're saying that a company is liable if they ship bugs, which the GDPR absolutely doesn't care about.
  - ribosometronome 8y ago
    This update is available to iPhones from the 5S and newer. The 5S was released in 2013. If your phone is older than that, it's a bit older than "not brand new".
    - jtbayly 8y ago
      I think the point is that he has an Android, but he can't update, while Apple users can.
      - he6s4vyu 8y ago
        If he bought an Android it's because he doesn't care about the security of his phone. Not trying to be snarky; Android has been around for over 10 years and we all know how irresponsible all OEMs are, including Google. He had the information when he made his purchase.
        skybrian 8y ago
        Or alternately, you buy from Google, keep up with OS upgrades, and plan on buying a new phone every 2-3 years or so. While not ideal, this is certainly doable.
        scarface74 8y ago
        So the only way that you can get an Android phone with any type of security is by buying one from Google. So much for Andy Rubin and his promise of openness and choices...
        skybrian 8y ago
        Motorola is pretty good too. Maybe others?
        mav3rick 8y ago
        The other alternative is also locked into one company.
syshum 8y ago
I hold the more unpopular opinion the "Responsible" Disclosure is anything but, and everything should be fully disclosed in real time If I was running project zero I would not even give them the 30/90 days Full Disclosure is the best way
- ggggtez 8y ago
  I can understand this. Both of these options are better than what it was like in the 90's though. Back then it was "inform company about a bug, and get a non-disclosure agreement forced on you or a visit from the FBI". People forget that one of the reasons the 90's was such a hayday for hackers was that companies tried to fight hackers with court orders instead of actually fixing their stuff.
  - kstrauser 8y ago
    That's exactly right. I'm firmly of the opinion that "we'll give you 90 days to fix it before announcing" is responsible disclosure, as it motivates people to actually fix their stuff as opposed to filing the report away in the circular Jira.
    - syshum 8y ago
      I can somewhat get on board until the moment a 0day is observed in the wild, then it should be disclosed. i can not protect my systems from things I am not aware of, allowing a vulnerability to be exploited for 60 days when on day 29 of "responsible disclosure" window the vulnerability was observed being actively exploited is not responsible either.
      - kstrauser 8y ago
        I'm with you. On that day, I assume everyone in the world except me knows how to exploit my system, and the vendor is racing the clock.
VikingCoder 8y ago
> the most valuable company on Earth Please edit to say "one of the most valuable companies on Earth," as it is absolutely not the most valuable (Market Cap). In fact, it's currently less than Apple. ($781B / $803B)
the_duke 8y ago
Do you have any actual examples of this happening? It should be relatively easy to prove, by showing a disclosure from Project Zero without an accompanying acknowledgment/post from the company... So far, most of what I've seen has been good for security. Not least the whole Spectre/Meltdown mess.
wyldfire 8y ago
I will put aside Project Zero for a second -- in this particular case they're saying that they discovered that someone else has exploited the vulnerabilities. Perhaps that means that they weren't necessarily looking for them with analysis or fuzzing but a honeypot trapped a case where an attacker was successful. Can't we all agree that this discovery is to everyone's benefit? Google, Apple customers, Apple? With respects to the merits of Project Zero: > How fast do you think I would get sued ... I don't think you would but even if you would -- your argument really seems to underscore the value of Project Zero. Google can publicize these bugs and have the resources to stand up to lawsuits from irresponsible vendors. I'm not silly enough to think that Google doesn't exploit competitive advantages but in this case I think they are trying to catch up with the public perception of Apple's superiority wrt secure product design. Objectively we can see that's the case with many of the design elements of iOS vs Android. And it's not by putting down Apple that they do this, instead it's by demonstrating that they are leaders in security, not followers.
ggggtez 8y ago
I think believing Google is pretentious and unprofessional is one thing. But the other stuff you said doesn't make any sense. Why shouldn't they go public? Not everyone can spend their time reading patch notes. If a new patch comes out that fixes a security flaw, most people say "update later". But if you say "no really, criminals are using this attack RIGHT NOW", that can help a lot of people keep their devices safe.
Bhilai 8y ago
I would agree on some of them being pretentious, specially with their tease about undisclosed vulns on twitter. But not all their members engage in this. I disagree on everything else you say. Google P0 has definitely pushed companies like Microsoft and Apple to be better and this benefits all of us. Their 90 day policy pushes vendors to make overall improvements in their build, ship and update processes, helping us get faster updates for critical vulns. They forced the leadership at these companies to put security very high on the list. I am also pretty sure that Google is held pretty tightly to their own 90 day disclosure policy. Google runs a full fledged bug bounty program and external researchers do find critical bugs in Chrome, Android etc. and don't get sued by Google. With hundreds of critical bugs in major software (and hardware) their contribution to security is nothing less than stellar.

jayd16 8y ago

Has this ever happened with Google or is it pure speculation?

jasonvorhe 8y ago

They're using iPhones themselves inside of the company, trusting the devices as part of their Beyond Corp security mechanism, so they have an interest in the software trusted to their company network being as secure as possible.

6d6b73 8y ago
And we don't? I want my phone to be as secure as possible because I use it for work, but of course, since it's not brand new I can't get updates.
- WrtCdEvrydy 8y ago
  That's a symptom of cybersecurity. If a law made a security bug a refundable or warrantied defect, I bet you this shit would stop. But noone gives a shit.
  - hnnh44 8y ago
    It would also seriously stymie innovation. If I risk having to refund an item when I push out improvements, I'm never bothering to push out improvements except bug fixes. I'm also incentivized to release a new model every month with ANY improvement in order to limit my liability to a smaller window of revenue. The current system isn't perfect, but it could be much worse.
    - WrtCdEvrydy 8y ago
      What's worse that thousands of pieces of throwaway hardware that don't get updates? How about thousands of enterprise systems where the security updates are hidden behind support contacts? > when I push out improvements No, if your software has a security issue, it's refundable. Write good software. > release a new model every month with ANY improvement Good, but that doesn't remove your liability from your last model.
      - joshuamorton 8y ago
        >No, if your software has a security issue, it's refundable. Write good software. There are 0 companies that can provide consumer software on the lifecycle consumers have come to expect without any bugs. You write software. Are you willing to claim that you can just "write good software" and never ship anything with a security issues? Because otherwise you're advocating for consumer tools that use nasa's release cycle. Which like, that's cool and all but I don't want to rely on hardware from 2012 or 2005 running software that was developed from 2010-2014 and has just finished its verification process. You're advocating for a world where we just got the verifiably bug-free Nokia 3310. And that doesn't even begin to discuss the clusterfuck that would be open-source in this situation. Am I liable for heartbleed because I use OpenSSL? Are the openSSL devs?
        WrtCdEvrydy 8y ago
        Same bullshit argument was made about GDPR and we survived that... there's just too much money to be made by outsourcing your shitty code's security bugs onto the customer.
        joshuamorton 8y ago
        Those aren't the same though. GDPR is basically "you are liable if you are actively exploited and data is stolen". You're saying that a company is liable if they ship bugs, which the GDPR absolutely doesn't care about.
- ribosometronome 8y ago
  This update is available to iPhones from the 5S and newer. The 5S was released in 2013. If your phone is older than that, it's a bit older than "not brand new".
  - jtbayly 8y ago
    I think the point is that he has an Android, but he can't update, while Apple users can.
    - he6s4vyu 8y ago
      If he bought an Android it's because he doesn't care about the security of his phone. Not trying to be snarky; Android has been around for over 10 years and we all know how irresponsible all OEMs are, including Google. He had the information when he made his purchase.
      - skybrian 8y ago
        Or alternately, you buy from Google, keep up with OS upgrades, and plan on buying a new phone every 2-3 years or so. While not ideal, this is certainly doable.
        scarface74 8y ago
        So the only way that you can get an Android phone with any type of security is by buying one from Google. So much for Andy Rubin and his promise of openness and choices...
        skybrian 8y ago
        Motorola is pretty good too. Maybe others?
        mav3rick 8y ago
        The other alternative is also locked into one company.

syshum 8y ago

I hold the more unpopular opinion the "Responsible" Disclosure is anything but, and everything should be fully disclosed in real time If I was running project zero I would not even give them the 30/90 days Full Disclosure is the best way

ggggtez 8y ago
I can understand this. Both of these options are better than what it was like in the 90's though. Back then it was "inform company about a bug, and get a non-disclosure agreement forced on you or a visit from the FBI". People forget that one of the reasons the 90's was such a hayday for hackers was that companies tried to fight hackers with court orders instead of actually fixing their stuff.
- kstrauser 8y ago
  That's exactly right. I'm firmly of the opinion that "we'll give you 90 days to fix it before announcing" is responsible disclosure, as it motivates people to actually fix their stuff as opposed to filing the report away in the circular Jira.
  - syshum 8y ago
    I can somewhat get on board until the moment a 0day is observed in the wild, then it should be disclosed. i can not protect my systems from things I am not aware of, allowing a vulnerability to be exploited for 60 days when on day 29 of "responsible disclosure" window the vulnerability was observed being actively exploited is not responsible either.
    - kstrauser 8y ago
      I'm with you. On that day, I assume everyone in the world except me knows how to exploit my system, and the vendor is racing the clock.

VikingCoder 8y ago

> the most valuable company on Earth Please edit to say "one of the most valuable companies on Earth," as it is absolutely not the most valuable (Market Cap). In fact, it's currently less than Apple. ($781B / $803B)

the_duke 8y ago

Do you have any actual examples of this happening? It should be relatively easy to prove, by showing a disclosure from Project Zero without an accompanying acknowledgment/post from the company... So far, most of what I've seen has been good for security. Not least the whole Spectre/Meltdown mess.

wyldfire 8y ago

I will put aside Project Zero for a second -- in this particular case they're saying that they discovered that someone else has exploited the vulnerabilities. Perhaps that means that they weren't necessarily looking for them with analysis or fuzzing but a honeypot trapped a case where an attacker was successful. Can't we all agree that this discovery is to everyone's benefit? Google, Apple customers, Apple? With respects to the merits of Project Zero: > How fast do you think I would get sued ... I don't think you would but even if you would -- your argument really seems to underscore the value of Project Zero. Google can publicize these bugs and have the resources to stand up to lawsuits from irresponsible vendors. I'm not silly enough to think that Google doesn't exploit competitive advantages but in this case I think they are trying to catch up with the public perception of Apple's superiority wrt secure product design. Objectively we can see that's the case with many of the design elements of iOS vs Android. And it's not by putting down Apple that they do this, instead it's by demonstrating that they are leaders in security, not followers.

ggggtez 8y ago

I think believing Google is pretentious and unprofessional is one thing. But the other stuff you said doesn't make any sense. Why shouldn't they go public? Not everyone can spend their time reading patch notes. If a new patch comes out that fixes a security flaw, most people say "update later". But if you say "no really, criminals are using this attack RIGHT NOW", that can help a lot of people keep their devices safe.

Bhilai 8y ago

I would agree on some of them being pretentious, specially with their tease about undisclosed vulns on twitter. But not all their members engage in this. I disagree on everything else you say. Google P0 has definitely pushed companies like Microsoft and Apple to be better and this benefits all of us. Their 90 day policy pushes vendors to make overall improvements in their build, ship and update processes, helping us get faster updates for critical vulns. They forced the leadership at these companies to put security very high on the list. I am also pretty sure that Google is held pretty tightly to their own 90 day disclosure policy. Google runs a full fledged bug bounty program and external researchers do find critical bugs in Chrome, Android etc. and don't get sued by Google. With hundreds of critical bugs in major software (and hardware) their contribution to security is nothing less than stellar.