6 ms·

Giving a company 90 days to fix a problem that may be currently exploited, harming end users, seems nasty to you? We should all be so lucky as to have Project

Giving a company 90 days to fix a problem that may be currently exploited, harming end users, seems nasty to you? We should all be so lucky as to have Project Zero handing us free bug reports like that. Responsible companies PAY for bug reports on their products. Google is handing them over for free.

rootusrootus 7y ago
Apple has a bug bounty program, yes? Are they paying Google for these?
- devrand 7y ago
  Project Zero does not accept bounties. They generally ask for the money to be donated.
  - rootusrootus 7y ago
    Makes sense. The bug bounty is meaningful money to an individual but it's just a pittance to Google.
    - deleted 7y ago
      [deleted]
    - saagarjha 7y ago
      I'd assume it also helps avoid the perception of a conflict of interest.
- bobviolier 7y ago
  Probably not. I think that most of those bounties can only be redeemed when you sign an NDA.
  - jefftk 7y ago
    Who requires an NDA? I don't believe Google does: https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ (Disclosure: I work for Google)
    - bobviolier 7y ago
      I meant the NDA from the party where the bug is reported, Apple in this case.
- saagarjha 7y ago
  Apple's program has a few very specific classes of bugs that they pay out bounties for: these bugs probably don't qualify.
Jasper_ 7y ago
Sure, but at the same time, when Google announced that Google+ had a huge security breach of 52M accounts, they didn't publicly disclose it until well after the fact because they didn't think it was serious enough. I wish Google would follow their own principles.
- tptacek 7y ago
  By that standard, literally no company in the industry is following these principles, because internal findings are not routinely disclosed. Internal vulnerability researchers have access to information outsiders don't, so you can imagine, the bugs you're not hearing about are pretty lurid. Every major tech company in North America spends millions annually on third-party software security tests; did you think these just weren't turning things up? What did you think was happening to the reports?
  - Jasper_ 7y ago
    Google's goal with Project Zero is supposedly to raise the stakes in security. I'm happy they're doing it, but if they're going to enforce a non-negotiable 90 days public disclosure policy, it leaves a bad taste in my mouth when Google itself doesn't care to follow that for their own services. Project Zero has long maintained that any serious company should be able to meet 90 day disclosure timeframe, and yet here comes Google+...
    - ijpoijpoihpiuoh 7y ago
      Project Zero was not the group that discovered the G+ vulnerability, though. Project Zero's terms do not bind other teams within the company who have not agreed to them.
    - kps 7y ago
      But it's not non-negotiable. https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label:Deadline-Grace https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
  - bzbarsky 7y ago
gravelordnito 7y ago
Yeah, all they get in return is the chance to shit on competitors and possibly leave their customers open to harm, while getting lauded by the people who still think google isn't evil.
- VikingCoder 7y ago
  The company with the bug is leaving their customers open to harm. And Project Zero has notified that company of their problem. If the company fixes their problem in a reasonable amount of time, then it's a Win-Win-Win. The users, the company, and Project Zero all win. If you blame anyone but the companies with bugs that can't fix them in a reasonable amount of time, then your priorities are dead wrong.

rootusrootus 7y ago

Apple has a bug bounty program, yes? Are they paying Google for these?

devrand 7y ago
Project Zero does not accept bounties. They generally ask for the money to be donated.
- rootusrootus 7y ago
  Makes sense. The bug bounty is meaningful money to an individual but it's just a pittance to Google.
  - deleted 7y ago
    [deleted]
  - saagarjha 7y ago
    I'd assume it also helps avoid the perception of a conflict of interest.
bobviolier 7y ago
Probably not. I think that most of those bounties can only be redeemed when you sign an NDA.
- jefftk 7y ago
  Who requires an NDA? I don't believe Google does: https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ (Disclosure: I work for Google)
  - bobviolier 7y ago
    I meant the NDA from the party where the bug is reported, Apple in this case.
saagarjha 7y ago
Apple's program has a few very specific classes of bugs that they pay out bounties for: these bugs probably don't qualify.

Jasper_ 7y ago

Sure, but at the same time, when Google announced that Google+ had a huge security breach of 52M accounts, they didn't publicly disclose it until well after the fact because they didn't think it was serious enough. I wish Google would follow their own principles.

tptacek 7y ago
By that standard, literally no company in the industry is following these principles, because internal findings are not routinely disclosed. Internal vulnerability researchers have access to information outsiders don't, so you can imagine, the bugs you're not hearing about are pretty lurid. Every major tech company in North America spends millions annually on third-party software security tests; did you think these just weren't turning things up? What did you think was happening to the reports?
- Jasper_ 7y ago
  Google's goal with Project Zero is supposedly to raise the stakes in security. I'm happy they're doing it, but if they're going to enforce a non-negotiable 90 days public disclosure policy, it leaves a bad taste in my mouth when Google itself doesn't care to follow that for their own services. Project Zero has long maintained that any serious company should be able to meet 90 day disclosure timeframe, and yet here comes Google+...
  - ijpoijpoihpiuoh 7y ago
    Project Zero was not the group that discovered the G+ vulnerability, though. Project Zero's terms do not bind other teams within the company who have not agreed to them.
  - kps 7y ago
    But it's not non-negotiable. https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label:Deadline-Grace https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- bzbarsky 7y ago

gravelordnito 7y ago

Yeah, all they get in return is the chance to shit on competitors and possibly leave their customers open to harm, while getting lauded by the people who still think google isn't evil.

VikingCoder 7y ago
The company with the bug is leaving their customers open to harm. And Project Zero has notified that company of their problem. If the company fixes their problem in a reasonable amount of time, then it's a Win-Win-Win. The users, the company, and Project Zero all win. If you blame anyone but the companies with bugs that can't fix them in a reasonable amount of time, then your priorities are dead wrong.