8 ms·

Words are wonderful. Try saying it this way: Google is spending millions of their own dollars to freely help other companies (and themselves!) enhance their se

Words are wonderful. Try saying it this way: Google is spending millions of their own dollars to freely help other companies (and themselves!) enhance their security and close holes malicious actors can exploit. Now replace "Google" with any other company or independent researcher of your choice. If you're no longer angry, you're being biased solely because its Google and not someone you like.

sildur 7y ago
I replaced Google with Microsoft, Oracle and SCO, and the feeling is the same.
- 0x6c6f6c 7y ago
  So, you're not okay with white hats or security researchers at all then
  - kiallmacinnes 7y ago
    I suspect it's large companies, given the names provided. Really, I don't get peoples hatred for Project Zero. Sure, hate the companies, but can you seriously argue that companies spending money on security research is a bad thing? Even if gasp they might get some good publicity from that research?
    - qarlow 7y ago
      I don't think it is much more complicated than that some of us don't want to grant even more power to companies like Google.
      - kiallmacinnes 7y ago
        Power? I don't see much power being granted here. And if you rule out "all companies like Google", you've basically ruled out everyone with enough capital to donate to research, depending on your definition of "like Google". And really, it absolutely is a donation. The ROI on Project Zero is likely 50x or more less than if that money went to the marketing team.
        qarlow 7y ago
        > Power? I don't see much power being granted here. And I am not going try to convince you in a popularity based forum, but that is generally the objection.
        gmanley 7y ago
        If you don't want to engage in discussion why are you even commenting here in the first place? You are saying that this gives more power to google and someone asked if you could elaborate on why you think that. Not everyone has the same background and what may be obvious power to you may not be to others. This forum is supposed to be participated in with good faith.
        kiallmacinnes 7y ago
        To be fair to them, while you understood my intent - I definitely could have phrased that better.
        qarlow 7y ago
        Thankfully there are many ways to participate. But maybe I was a bit short. My point is that if you don't 'meet me half way' I can't do the subject justice in a forum where a significant number of the comments arguing that point is hidden. That increases my effort to make an effective argument and diminishes my returns for that effort. Especially since I don't feel that strongly about it. You are better off trying to find a blog post about it that won't disappear in a couple of hours. But on the other hand meta isn't that interesting either. If large companies wanted to do security research that wasn't objectionable to people they could do so by consensus, standards and agreements. No one could really question that. Instead the idea is largely that "the ends justify the means". That is what people tend to disagree with. That large companies can unilaterally decide how things are done, not just for themselves but in a way that affects other companies or their users. It doesn't really matter if it is for good or best practice because it is about them, especially as large companies in the industry, having that influence.
    - levythe 7y ago
      I guess the issue is that very little discovered internally will ever be publicly disclosed. It feels like a tactic to make themselves look more secure than others when that is not likely the case. That being said, I think the same behavior is to be expected from any company large enough to need a dedicated security research team.
      - kiallmacinnes 7y ago
        > I guess the issue is that very little discovered internally will ever be publicly disclosed. It feels like a tactic to make themselves look more secure than others when that is not likely the case. Agreed, and I don't think for a second Google as a whole is any different in this regard. But who cares? Security issues are being found, Security issues are being publicized, Security issues are being fixed. Project Zero, as a small part of Google, is finding bugs in everyones software - including Google's - and holding them to the same standards, standards which are widely regarded as being acceptable standards for disclosure. The rest of Google, should they discover an issue without Project Zero's help, presumably behave just as most of other companies do - so hate them all equally, that's fine - and I agree, but Project Zero is different to Google as a whole, and just is not something to hate IMO.
      - slavak 7y ago
        Project Zero absolutely covers vulnerabilities in Google products. Just take a look at the blog archives (https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/). Chrome and Chromium seem to be frequent features, but they cover other Google properties as well.
    - gravelordnito 7y ago
      Except google has good reason to want iPhone customers to feel unsafe, to have apple blamed for issues, etc...
      - ziddoap 7y ago
        > good reason to want iPhone customers to feel unsafe How does fixing vulnerabilities in your iPhone make you feel unsafe? > apple blamed for issues Apple is being blamed for the issues because Apple is to blame for the issues. They made the product. Who is to blame about the security issues in an Apple product, if not Apple?
    - ocdtrekkie 7y ago
      It's how it's used. Like how when Epic decided Fortnite should skip the Google Play Store and it's 30% cut, Project Zero suddenly was interested in checking the security of games (which you rarely if ever see), so they could find a vulnerability in it and feed it out to Google's favored press outlets with a constructed story about how Epic is compromising everyone's security by not using the Play Store. (Don't mind all the stories about malware in the Play Store, of course.) As soon as a company slighted Google, it was immediately a Project Zero target, and that should tell you everything you need to know about why people are annoyed with them.
      - kiallmacinnes 7y ago
        IMO, your making an pretty large assumption here - you're describing the intent as malicious without anything concrete to back it up. If I was a security researcher, and someone decided to do something out of the norm, I'd probe it! There's nothing here to suggest malicious intent, only a security researcher doing what a security researcher does. > with a constructed story about how Epic is compromising everyone's security Did Epic compromise everyone's (or, at least their users) security? My memory of that incident is, yes - they did. If that's true, if the code was buggy and had a path to a security exploit, how is it a "constructed story"?
        ocdtrekkie 7y ago
        If I recall the issue in question, the only way it would be vulnerable to anything was... if someone already had another malicious app installed on their phone. Which is to say, you could get infected by already being infected, which is... not much of a vulnerability.
        pvg 7y ago
        Which is to say, you could get infected by already being infected, which is... not much of a vulnerability. It's a pretty big vulnerability when you allow the malicious intent of one app to escalate to an actual malicious capability so I don't think you're accurately recalling the issue in question.
  - deleted 7y ago
    [deleted]
- mehrdadn 7y ago
  What if your replace it with, say, Stripe?
- ziftface 7y ago
  What about the NSA, or GRU? Because they're doing this research too, except they're not publishing it.
ctrl-j 7y ago
My biggest question would be how many security vulnerabilities Google uncovered and disclosed on their own platform. If they are being good and helping other companies - great! But if they're also profiting by FUD'ing them - then we should call them something other than white hats.. grey hats maybe?
- FireBeyond 7y ago
  https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ Plenty of uncovered and disclosed vulnerabilities for Android and Chrome there.
- deleted 7y ago
  [deleted]
- kps 7y ago
  > My biggest question would be how many security vulnerabilities Google uncovered and disclosed on their own platform. 130.
- kevin_thibedeau 7y ago
  Google fixes its shit before the 90 day deadline. Apple could hire the talent it needs to do the same.
  - slavak 7y ago
    It also absolutely discloses its shit after they patch it.
  - scarface74 7y ago
    Well, Apple released a patch for all phones back to the 4s released in 2011. What are the chances that security patches for Android phones make it to phones released even two years ago? Even Microsoft released a patch recently to a security vulnerability found in Windows XP.
    - kevin_thibedeau 7y ago
jschwartzi 7y ago
Of course I'm biased. Google is a huge multinational corporation with a vested interest in keeping me on their platform. They're not researching vulnerabilities in Apple's products out of the goodness of their hearts, and although I agree that they're probably doing the right thing in this case, the fact that they're releasing the vulnerabilities at all probably has some ulterior motives.
- DannyBee 7y ago
  This is you, projecting, based on how you would operate. Unless you have actual evidence, don't put that on them.
gravelordnito 7y ago
A security company doing this (disclosing apple/ms vulnerabilities) wouldn't be going after their competitors. > you're being biased solely because its Google and not someone you like. We should be biased against Google, in everything.
- ziddoap 7y ago
  Why wouldn't a team of vulnerability researchers... research vulnerabilities?
- UncleMeat 7y ago
  Vuln reporting is free work. It helps companies. This isn't "going after" people.
sixothree 7y ago
What I said should have conveyed no opinion. Why would you change the words?
- johnday 7y ago
  "Expose" is a loaded term in many cultures. In particular it means to reveal something which the other party was trying to hide, usually in an adversarial way.
- TotempaaltJ 7y ago
  Your message shows how this situation can be framed to create a negative opinion towards Google. The wording of "on the surface it appears" implies that showing that was the purpose of the message.
- ziddoap 7y ago
  The other folk have given some (correct) reasons why I read an opinion in your message. But, here was my thought process. If I was wrong in how I understood your message, my apologies. >On the surface it appears This implies an ulterior motive. >expose flaws As mentioned, "expose" is an emotionally charged word with negative connotation. >in competitor's products. P0 does not just focus on competitors products, by any stretch. Your statement also fails to convey that they notified Apple with industry accepted disclosure practices in order to fix the vulnerabilities, rather than just "expose flaws".

sildur 7y ago

I replaced Google with Microsoft, Oracle and SCO, and the feeling is the same.

0x6c6f6c 7y ago
So, you're not okay with white hats or security researchers at all then
- kiallmacinnes 7y ago
  I suspect it's large companies, given the names provided. Really, I don't get peoples hatred for Project Zero. Sure, hate the companies, but can you seriously argue that companies spending money on security research is a bad thing? Even if gasp they might get some good publicity from that research?
  - qarlow 7y ago
    I don't think it is much more complicated than that some of us don't want to grant even more power to companies like Google.
    - kiallmacinnes 7y ago
      Power? I don't see much power being granted here. And if you rule out "all companies like Google", you've basically ruled out everyone with enough capital to donate to research, depending on your definition of "like Google". And really, it absolutely is a donation. The ROI on Project Zero is likely 50x or more less than if that money went to the marketing team.
      - qarlow 7y ago
        > Power? I don't see much power being granted here. And I am not going try to convince you in a popularity based forum, but that is generally the objection.
        gmanley 7y ago
        If you don't want to engage in discussion why are you even commenting here in the first place? You are saying that this gives more power to google and someone asked if you could elaborate on why you think that. Not everyone has the same background and what may be obvious power to you may not be to others. This forum is supposed to be participated in with good faith.
        kiallmacinnes 7y ago
        To be fair to them, while you understood my intent - I definitely could have phrased that better.
        qarlow 7y ago
        Thankfully there are many ways to participate. But maybe I was a bit short. My point is that if you don't 'meet me half way' I can't do the subject justice in a forum where a significant number of the comments arguing that point is hidden. That increases my effort to make an effective argument and diminishes my returns for that effort. Especially since I don't feel that strongly about it. You are better off trying to find a blog post about it that won't disappear in a couple of hours. But on the other hand meta isn't that interesting either. If large companies wanted to do security research that wasn't objectionable to people they could do so by consensus, standards and agreements. No one could really question that. Instead the idea is largely that "the ends justify the means". That is what people tend to disagree with. That large companies can unilaterally decide how things are done, not just for themselves but in a way that affects other companies or their users. It doesn't really matter if it is for good or best practice because it is about them, especially as large companies in the industry, having that influence.
  - levythe 7y ago
    I guess the issue is that very little discovered internally will ever be publicly disclosed. It feels like a tactic to make themselves look more secure than others when that is not likely the case. That being said, I think the same behavior is to be expected from any company large enough to need a dedicated security research team.
    - kiallmacinnes 7y ago
      > I guess the issue is that very little discovered internally will ever be publicly disclosed. It feels like a tactic to make themselves look more secure than others when that is not likely the case. Agreed, and I don't think for a second Google as a whole is any different in this regard. But who cares? Security issues are being found, Security issues are being publicized, Security issues are being fixed. Project Zero, as a small part of Google, is finding bugs in everyones software - including Google's - and holding them to the same standards, standards which are widely regarded as being acceptable standards for disclosure. The rest of Google, should they discover an issue without Project Zero's help, presumably behave just as most of other companies do - so hate them all equally, that's fine - and I agree, but Project Zero is different to Google as a whole, and just is not something to hate IMO.
    - slavak 7y ago
      Project Zero absolutely covers vulnerabilities in Google products. Just take a look at the blog archives (https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/). Chrome and Chromium seem to be frequent features, but they cover other Google properties as well.
  - gravelordnito 7y ago
    Except google has good reason to want iPhone customers to feel unsafe, to have apple blamed for issues, etc...
    - ziddoap 7y ago
      > good reason to want iPhone customers to feel unsafe How does fixing vulnerabilities in your iPhone make you feel unsafe? > apple blamed for issues Apple is being blamed for the issues because Apple is to blame for the issues. They made the product. Who is to blame about the security issues in an Apple product, if not Apple?
  - ocdtrekkie 7y ago
    It's how it's used. Like how when Epic decided Fortnite should skip the Google Play Store and it's 30% cut, Project Zero suddenly was interested in checking the security of games (which you rarely if ever see), so they could find a vulnerability in it and feed it out to Google's favored press outlets with a constructed story about how Epic is compromising everyone's security by not using the Play Store. (Don't mind all the stories about malware in the Play Store, of course.) As soon as a company slighted Google, it was immediately a Project Zero target, and that should tell you everything you need to know about why people are annoyed with them.
    - kiallmacinnes 7y ago
      IMO, your making an pretty large assumption here - you're describing the intent as malicious without anything concrete to back it up. If I was a security researcher, and someone decided to do something out of the norm, I'd probe it! There's nothing here to suggest malicious intent, only a security researcher doing what a security researcher does. > with a constructed story about how Epic is compromising everyone's security Did Epic compromise everyone's (or, at least their users) security? My memory of that incident is, yes - they did. If that's true, if the code was buggy and had a path to a security exploit, how is it a "constructed story"?
      - ocdtrekkie 7y ago
        If I recall the issue in question, the only way it would be vulnerable to anything was... if someone already had another malicious app installed on their phone. Which is to say, you could get infected by already being infected, which is... not much of a vulnerability.
        pvg 7y ago
        Which is to say, you could get infected by already being infected, which is... not much of a vulnerability. It's a pretty big vulnerability when you allow the malicious intent of one app to escalate to an actual malicious capability so I don't think you're accurately recalling the issue in question.
- deleted 7y ago
  [deleted]
mehrdadn 7y ago
What if your replace it with, say, Stripe?
ziftface 7y ago
What about the NSA, or GRU? Because they're doing this research too, except they're not publishing it.

ctrl-j 7y ago

My biggest question would be how many security vulnerabilities Google uncovered and disclosed on their own platform. If they are being good and helping other companies - great! But if they're also profiting by FUD'ing them - then we should call them something other than white hats.. grey hats maybe?

FireBeyond 7y ago
https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ Plenty of uncovered and disclosed vulnerabilities for Android and Chrome there.
deleted 7y ago
[deleted]
kps 7y ago
> My biggest question would be how many security vulnerabilities Google uncovered and disclosed on their own platform. 130.
kevin_thibedeau 7y ago
Google fixes its shit before the 90 day deadline. Apple could hire the talent it needs to do the same.
- slavak 7y ago
  It also absolutely discloses its shit after they patch it.
- scarface74 7y ago
  Well, Apple released a patch for all phones back to the 4s released in 2011. What are the chances that security patches for Android phones make it to phones released even two years ago? Even Microsoft released a patch recently to a security vulnerability found in Windows XP.
  - kevin_thibedeau 7y ago

jschwartzi 7y ago

Of course I'm biased. Google is a huge multinational corporation with a vested interest in keeping me on their platform. They're not researching vulnerabilities in Apple's products out of the goodness of their hearts, and although I agree that they're probably doing the right thing in this case, the fact that they're releasing the vulnerabilities at all probably has some ulterior motives.

DannyBee 7y ago
This is you, projecting, based on how you would operate. Unless you have actual evidence, don't put that on them.

gravelordnito 7y ago

A security company doing this (disclosing apple/ms vulnerabilities) wouldn't be going after their competitors. > you're being biased solely because its Google and not someone you like. We should be biased against Google, in everything.

ziddoap 7y ago
Why wouldn't a team of vulnerability researchers... research vulnerabilities?
UncleMeat 7y ago
Vuln reporting is free work. It helps companies. This isn't "going after" people.

sixothree 7y ago

What I said should have conveyed no opinion. Why would you change the words?

johnday 7y ago
"Expose" is a loaded term in many cultures. In particular it means to reveal something which the other party was trying to hide, usually in an adversarial way.
TotempaaltJ 7y ago
Your message shows how this situation can be framed to create a negative opinion towards Google. The wording of "on the surface it appears" implies that showing that was the purpose of the message.
ziddoap 7y ago
The other folk have given some (correct) reasons why I read an opinion in your message. But, here was my thought process. If I was wrong in how I understood your message, my apologies. >On the surface it appears This implies an ulterior motive. >expose flaws As mentioned, "expose" is an emotionally charged word with negative connotation. >in competitor's products. P0 does not just focus on competitors products, by any stretch. Your statement also fails to convey that they notified Apple with industry accepted disclosure practices in order to fix the vulnerabilities, rather than just "expose flaws".