5 ms·

So far the two parent comments are quite negative, which surprises me. I understand the anti-Google sentiment, but Project Zero has been a much needed booster t

So far the two parent comments are quite negative, which surprises me. I understand the anti-Google sentiment, but Project Zero has been a much needed booster to the security of the public and it has born fruit. The fact that an iOS vulnerability is actively being exploited is notable. I think their method of responsible disclosure is reasonable.

juau 8y ago
Google in general has a pretty bad reputation when it comes to considering others. Which is usually fine because it is their business. Project Zero is different, but they adopt largely the same, or even worse, attitude. And at the end of the day software is a "human business". But it's a contentious issue so I am not sure it is worth discussing in a popularity based forum.
dtornabene 8y ago
I'm about as far from a Google fanboy as one can get, but I'm definitely seconding this comment. Project Zero, OSS-Fuzz, a host of other projects have contributed enormously to software security in the last few years.
jsgo 8y ago
There are cases that I'm all for bashing Google when they don't give the company they're targeting enough time to patch something (recently, seems mostly directed at Microsoft). This isn't one of those cases. They seem to have waited until Apple had a patch ready, they disclosed it to Apple and gave them an adequate amount of time to patch the vulnerability, and users are better for it. So in this case and others similar to it, kudos to Google.
- PurpleBoxDragon 8y ago
  >There are cases that I'm all for bashing Google when they don't give the company they're targeting enough time to patch something While I understand the common ethos of our current culture supports this, has there been analysis if giving what could constitute a second chance to fix security issues leads to less prioritization of security initially? I could definitely see a business deciding to lower their security expenditure since if an issue is found, they will be given a grace window to fix it before the world hears about it. It would still be damaging, but it would be far less since the PR machine could spit out that it was patched before it was announced to the world. There has to have been some agreement to limit the grace period since people will go live once a reasonable time frame to fix it has passed and they won't be judged negatively if others agree reasonable time was given. So if we won't judge someone for giving only 6 months instead of 3 years, what about the one who gives only 2 weeks instead of 6 months? How do we calculate which of two time frames is better?
  - kerng 8y ago
    If only Google would hold themselves accountable to the same standard. Android is a gigantic security mess, all caused and enabled by Google.
    - kllrnohj 8y ago
      No it isn't? Android has a bug bounty program: https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/ and regularly has strong showings at pwn2own. Android's security for the past couple of years has been superb.
      - justapassenger 8y ago
        Android as an abstract project, yes. Android, as what's actually used by users, it's not that superb. Google is slowly trying to fix it, but average Android device is way behind average iOS device in the wild, and that will be the case for many years to come.
        kllrnohj 8y ago
        > Android, as what's actually used by users, it's not that superb. It is, though. The Android that's most commonly used by users is the one from Samsung, who also issues monthly security patches for a large range of devices: https://security.samsungmobile.com/workScope.smsb https://security.samsungmobile.com/workScope.smsb LG ( https://lgsecurity.lge.com/security_updates.html https://lgsecurity.lge.com/security_updates.html ) does as well, and so do at least Motorola & Nokia. > average Android device is way behind average iOS device in the wild, and that will be the case for many years to come. [citation needed] Average iOS device just got hit by 2 zero-days in the wild. And jailbreaking is a long and well established practice on iOS, which is literally privilege escalation exploits. There's a constant, continuous stream of those on iOS. There doesn't seem to be many (any?) on Android for a while now.
        joshuamorton 8y ago
Spooky23 8y ago
Agreed — also these vulnerabilities can put human life at risk, as we’ve seen in recent months.

juau 8y ago

Google in general has a pretty bad reputation when it comes to considering others. Which is usually fine because it is their business. Project Zero is different, but they adopt largely the same, or even worse, attitude. And at the end of the day software is a "human business". But it's a contentious issue so I am not sure it is worth discussing in a popularity based forum.

dtornabene 8y ago

I'm about as far from a Google fanboy as one can get, but I'm definitely seconding this comment. Project Zero, OSS-Fuzz, a host of other projects have contributed enormously to software security in the last few years.

jsgo 8y ago

There are cases that I'm all for bashing Google when they don't give the company they're targeting enough time to patch something (recently, seems mostly directed at Microsoft). This isn't one of those cases. They seem to have waited until Apple had a patch ready, they disclosed it to Apple and gave them an adequate amount of time to patch the vulnerability, and users are better for it. So in this case and others similar to it, kudos to Google.

PurpleBoxDragon 8y ago
>There are cases that I'm all for bashing Google when they don't give the company they're targeting enough time to patch something While I understand the common ethos of our current culture supports this, has there been analysis if giving what could constitute a second chance to fix security issues leads to less prioritization of security initially? I could definitely see a business deciding to lower their security expenditure since if an issue is found, they will be given a grace window to fix it before the world hears about it. It would still be damaging, but it would be far less since the PR machine could spit out that it was patched before it was announced to the world. There has to have been some agreement to limit the grace period since people will go live once a reasonable time frame to fix it has passed and they won't be judged negatively if others agree reasonable time was given. So if we won't judge someone for giving only 6 months instead of 3 years, what about the one who gives only 2 weeks instead of 6 months? How do we calculate which of two time frames is better?
- kerng 8y ago
  If only Google would hold themselves accountable to the same standard. Android is a gigantic security mess, all caused and enabled by Google.
  - kllrnohj 8y ago
    No it isn't? Android has a bug bounty program: https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/ and regularly has strong showings at pwn2own. Android's security for the past couple of years has been superb.
    - justapassenger 8y ago
      Android as an abstract project, yes. Android, as what's actually used by users, it's not that superb. Google is slowly trying to fix it, but average Android device is way behind average iOS device in the wild, and that will be the case for many years to come.
      - kllrnohj 8y ago
        > Android, as what's actually used by users, it's not that superb. It is, though. The Android that's most commonly used by users is the one from Samsung, who also issues monthly security patches for a large range of devices: https://security.samsungmobile.com/workScope.smsb https://security.samsungmobile.com/workScope.smsb LG ( https://lgsecurity.lge.com/security_updates.html https://lgsecurity.lge.com/security_updates.html ) does as well, and so do at least Motorola & Nokia. > average Android device is way behind average iOS device in the wild, and that will be the case for many years to come. [citation needed] Average iOS device just got hit by 2 zero-days in the wild. And jailbreaking is a long and well established practice on iOS, which is literally privilege escalation exploits. There's a constant, continuous stream of those on iOS. There doesn't seem to be many (any?) on Android for a while now.
        joshuamorton 8y ago

Spooky23 8y ago

Agreed — also these vulnerabilities can put human life at risk, as we’ve seen in recent months.