8 ms·

It seems like peoples hatred for Google is leaking over to how they think vulnerability disclosures should happen. Reading through the comments is disorientati

It seems like peoples hatred for Google is leaking over to how they think vulnerability disclosures should happen. Reading through the comments is disorientating - people are angry that researchers are.. gasp... researching vulnerabilities. It's not some faceless Google Incarnate monstrosity, they are paid researchers (humans, too!). If it was Cure53 that did this, for free, and made the exact same announcement no one would bat an eye. Good on whatever company does vulnerability research, follows established protocols in disclosure, and makes the world a safer place.

mehrdadn 7y ago
My beef is with the established protocol (Google or not) and that is that you disclose enough details to potentially repro even if the vendor patches correctly and promptly. Why the hell suddenly put everyone's devices at immediate risk until they get a chance to update? That's "responsible"?
- drenvuk 7y ago
  Too many companies dont want to patch and won't do so unless forced.
  - mehrdadn 7y ago
    Yes, that's why you disclose if they don't do that. Not if they do.
    - drenvuk 7y ago
      Then it turns into blackmail. Indifference to their actions is necessary.
    - robocat 7y ago
      A patch for a security flaw exposes the flaw to anyone with deep enough pockets to reverse engineer the patch. Disclosing the flaw even if patched helps everyone, including you and me.
- metafunctor 7y ago
  I don't believe serious vulnerabilities, patched or not, would stay secret for long even if you tried. Disclosing motivates vendors to build systems to ensure users update their devices as quickly as possible.
nova22033 7y ago
People are complaining about quality security research...on hacker news!!
tptacek 7y ago
When I read these comments I also feel like people must believe P0 is some kind of new thing that Google came up with. In fact, vulnerability research labs have been A Thing in the security field since the mid-1990s (I worked at what I believe to be the first commercial vulnerability lab, at Secure Networks, from '96-'98, along with much smarter people like Tim Newsham and Ivan Arce). And they've always been taking this kind of (dumb) flak regardless of which company they're attached to. If companies like Apple or Microsoft are alarmed by the optics of Project Zero, they are free to stand up their own vulnerability research labs; they have the resources and they would immediately find takers in the research community. End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce specialized resources to public interest work. Vulnerabilities that P0 finds are vulnerabilities that aren't being sold through brokers to the global intelligence community. Message board talk about the "black market" alternative to bug bounties is almost always overblown, but P0 traffics in exactly the small subset of vulnerabilities that do have substantial, liquid markets.
- mehrdadn 7y ago
  > End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce specialized resources to public interest work. Why should end-users "have nothing but gratitude" when vulnerabilities are disclosed and they are immediately placed at risk until they get a chance to update, even when the vendor has promptly provided a correct patch? I know I certainly don't appreciate that and can't reasonably expect any normal person to appreciate it either.
  - tptacek 7y ago
    Obviously, because the alternative is that bugs never get patched, and get independently discovered by people who sell them to brokers instead. If you want to get angry about this, get angry at the vendor that took your money and time and attention and gave you a product with an exploitable security vulnerability in it. I think the issues involved here are a bit subtle to warrant knee-jerk anger, but if you've got to get angry, at least get angry in the right direction.
gravelordnito 7y ago
Except it's google leaking vulnerabilities that effect their direct competitors. They have way too much skin in the game.
- ziddoap 7y ago
  Project Zero has found, and disclosed, over 100 vulnerabilities for Google products. You're just going out of your way, trying to find things to dislike, and it shows.
- JamesSwift 7y ago
  So you are concerned that they are improving their competitors products but not their own? Doesn't it make more sense just to not do pro-bono research for their competitors?
Spooky23 7y ago
I really like both Apple and Google both of the companies make amazing products and come with different strengths and weaknesses. Project Zero is a great marketing effort that produces a genuine public good. But when you are the brains around the security dumpster fire that is Android, it's understandable to eyeroll the big PR splashes (ie. distractions) that that project generates. But hey, that's that market -- it is a valid strategy, and at the end of the day the world gets to learn and fix problems that they didn't know existed.

mehrdadn 7y ago

My beef is with the established protocol (Google or not) and that is that you disclose enough details to potentially repro even if the vendor patches correctly and promptly. Why the hell suddenly put everyone's devices at immediate risk until they get a chance to update? That's "responsible"?

drenvuk 7y ago
Too many companies dont want to patch and won't do so unless forced.
- mehrdadn 7y ago
  Yes, that's why you disclose if they don't do that. Not if they do.
  - drenvuk 7y ago
    Then it turns into blackmail. Indifference to their actions is necessary.
  - robocat 7y ago
    A patch for a security flaw exposes the flaw to anyone with deep enough pockets to reverse engineer the patch. Disclosing the flaw even if patched helps everyone, including you and me.
metafunctor 7y ago
I don't believe serious vulnerabilities, patched or not, would stay secret for long even if you tried. Disclosing motivates vendors to build systems to ensure users update their devices as quickly as possible.

nova22033 7y ago

People are complaining about quality security research...on hacker news!!

tptacek 7y ago

When I read these comments I also feel like people must believe P0 is some kind of new thing that Google came up with. In fact, vulnerability research labs have been A Thing in the security field since the mid-1990s (I worked at what I believe to be the first commercial vulnerability lab, at Secure Networks, from '96-'98, along with much smarter people like Tim Newsham and Ivan Arce). And they've always been taking this kind of (dumb) flak regardless of which company they're attached to. If companies like Apple or Microsoft are alarmed by the optics of Project Zero, they are free to stand up their own vulnerability research labs; they have the resources and they would immediately find takers in the research community. End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce specialized resources to public interest work. Vulnerabilities that P0 finds are vulnerabilities that aren't being sold through brokers to the global intelligence community. Message board talk about the "black market" alternative to bug bounties is almost always overblown, but P0 traffics in exactly the small subset of vulnerabilities that do have substantial, liquid markets.

mehrdadn 7y ago
> End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce specialized resources to public interest work. Why should end-users "have nothing but gratitude" when vulnerabilities are disclosed and they are immediately placed at risk until they get a chance to update, even when the vendor has promptly provided a correct patch? I know I certainly don't appreciate that and can't reasonably expect any normal person to appreciate it either.
- tptacek 7y ago
  Obviously, because the alternative is that bugs never get patched, and get independently discovered by people who sell them to brokers instead. If you want to get angry about this, get angry at the vendor that took your money and time and attention and gave you a product with an exploitable security vulnerability in it. I think the issues involved here are a bit subtle to warrant knee-jerk anger, but if you've got to get angry, at least get angry in the right direction.

gravelordnito 7y ago

Except it's google leaking vulnerabilities that effect their direct competitors. They have way too much skin in the game.

ziddoap 7y ago
Project Zero has found, and disclosed, over 100 vulnerabilities for Google products. You're just going out of your way, trying to find things to dislike, and it shows.
JamesSwift 7y ago
So you are concerned that they are improving their competitors products but not their own? Doesn't it make more sense just to not do pro-bono research for their competitors?

Spooky23 7y ago

I really like both Apple and Google both of the companies make amazing products and come with different strengths and weaknesses. Project Zero is a great marketing effort that produces a genuine public good. But when you are the brains around the security dumpster fire that is Android, it's understandable to eyeroll the big PR splashes (ie. distractions) that that project generates. But hey, that's that market -- it is a valid strategy, and at the end of the day the world gets to learn and fix problems that they didn't know existed.