5 ms·

The righteousness of your post reminds me of the climax of a Disney movie. Google does this all the time, on purpose, like clockwork. They aren't the only ones

The righteousness of your post reminds me of the climax of a Disney movie. Google does this all the time, on purpose, like clockwork. They aren't the only ones out there looking for zero days in their supply chain, but they're the only ones who ignore a vendors disclosure policy and substitute their own. For example; If Google finds a bug in your product YOU get 90 days before they put you on blast in front of 8 billion people. But if you find a bug in GOOGLE'S product and put them on blast YOU will find yourself in court. Does anyone remember the last time Microsoft or Apple went looking for zero days to drop in public on their blog about Google? They don't. Because they're professional companies with better shit to do than stir the pot. This has NOTHING to do wit supply chain security and EVERYTHING to do with putting heat on their competition. That is why PZ exists. If that weren't true PZ would be looking at non-competing products with large user bases. WordPress comes to mind. But Google doesn't compete with WordPress, so they'll never focus on it.

temac 7y ago
> For example; If Google finds a bug in your product YOU get 90 days before they put you on blast in front of 8 billion people. > But if you find a bug in GOOGLE'S product and put them on blast YOU will find yourself in court. Reference needed.
- zelon88 7y ago
  > For example; If Google finds a bug in your product YOU get 90 days before they put you on blast in front of 8 billion people. https://www.vice.com/en_us/article/7xqdxe/google-project-zero-hacker-iphone-bug-bounty https://www.vice.com/en_us/article/7xqdxe/google-project-zer... https://www.csoonline.com/article/2867534/microsoft-blasts-google-for-vulnerability-disclosure-policy.html https://www.csoonline.com/article/2867534/microsoft-blasts-g... Here are Google's many contradictory policies about disclosure. Notice the many discrepancies... https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... https://security.googleblog.com/2010/07/rebooting-responsible-disclosure-focus.html https://security.googleblog.com/2010/07/rebooting-responsibl... https://sites.google.com/site/bughunteruniversity/nonvuln https://sites.google.com/site/bughunteruniversity/nonvuln https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/ https://www.google.com/about/appsecurity/ https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... > But if you find a bug in GOOGLE'S product and put them on blast YOU will find yourself in court. Maybe a bit of a dramatization, but the point remains. If Google finds a bug in your product: Your policy is moot. They follow their policy. If you find a bug in their product you are expected to follow their policy. In the case of Apple their "security professionals" will make jokes about you on Twitter and in the case of Microsoft they just do whatever the fuck they want. "Your patches come out on Tuesday, huh? Well that's 92 days, big-guy! Tough break..."
  - a1369209993 7y ago
    > If you find a bug in their product you are expected to follow their policy. Is their policy more than 90 days? Yes? Fuck 'em; post everything everywhere.
    - icebraining 7y ago
      It's not; from parent's own links: "We of course expect to be held to the same standards ourselves."
      - fencepost 7y ago
        * impolitecough * Great, then they should start pushing OS security patches out to devices instead of handing them to manufacturers and carriers and washing their hands of them.
        hansjorg 7y ago
        They have started that. That's why more and more of Android has been moved to Google Play Services. Coincidentally, that's one of the reasons why being denied use of Android is such an obstacle for Huawei, even though it's "open source".
    - fencepost 7y ago
      You forgot to include "with pre-built exploit tooling built around what he explicitly said he spent a lot of time on." Project Zero has done some great things and improved a lot of security, but this feels like a spiteful slap at a competitor. It's not Google is really vulnerable to the same kind of thing, they've long since shown that the security of older versions of their only real public OS is not their concern.
      - a1369209993 7y ago
        > You forgot to include "with pre-built exploit tooling built around what he explicitly said he spent a lot of time on." No I didn't; I said everything and I meant everything. If anything, 90 days is overly generous to Google. If they can't get their shit together in three bloody months, fuck them. Of course, this is Google, so fuck them regardless, but this way you have obvious moral high ground.
tedunangst 7y ago
Perhaps there should be more heat on the competition. Microsoft could have found this problem as well, much easier even by reading their own internal documentation. They chose not to care.
Godel_unicode 7y ago
> looking at non-competing products with large user bases Like Linux? McAfee/Kaspersky/Malwarebytes/Symantec? LastPass? LG? Google's own software? Nvidia?

temac 7y ago

> For example; If Google finds a bug in your product YOU get 90 days before they put you on blast in front of 8 billion people. > But if you find a bug in GOOGLE'S product and put them on blast YOU will find yourself in court. Reference needed.

zelon88 7y ago
> For example; If Google finds a bug in your product YOU get 90 days before they put you on blast in front of 8 billion people. https://www.vice.com/en_us/article/7xqdxe/google-project-zero-hacker-iphone-bug-bounty https://www.vice.com/en_us/article/7xqdxe/google-project-zer... https://www.csoonline.com/article/2867534/microsoft-blasts-google-for-vulnerability-disclosure-policy.html https://www.csoonline.com/article/2867534/microsoft-blasts-g... Here are Google's many contradictory policies about disclosure. Notice the many discrepancies... https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... https://security.googleblog.com/2010/07/rebooting-responsible-disclosure-focus.html https://security.googleblog.com/2010/07/rebooting-responsibl... https://sites.google.com/site/bughunteruniversity/nonvuln https://sites.google.com/site/bughunteruniversity/nonvuln https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/ https://www.google.com/about/appsecurity/ https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... > But if you find a bug in GOOGLE'S product and put them on blast YOU will find yourself in court. Maybe a bit of a dramatization, but the point remains. If Google finds a bug in your product: Your policy is moot. They follow their policy. If you find a bug in their product you are expected to follow their policy. In the case of Apple their "security professionals" will make jokes about you on Twitter and in the case of Microsoft they just do whatever the fuck they want. "Your patches come out on Tuesday, huh? Well that's 92 days, big-guy! Tough break..."
- a1369209993 7y ago
  > If you find a bug in their product you are expected to follow their policy. Is their policy more than 90 days? Yes? Fuck 'em; post everything everywhere.
  - icebraining 7y ago
    It's not; from parent's own links: "We of course expect to be held to the same standards ourselves."
    - fencepost 7y ago
      * impolitecough * Great, then they should start pushing OS security patches out to devices instead of handing them to manufacturers and carriers and washing their hands of them.
      - hansjorg 7y ago
        They have started that. That's why more and more of Android has been moved to Google Play Services. Coincidentally, that's one of the reasons why being denied use of Android is such an obstacle for Huawei, even though it's "open source".
  - fencepost 7y ago
    You forgot to include "with pre-built exploit tooling built around what he explicitly said he spent a lot of time on." Project Zero has done some great things and improved a lot of security, but this feels like a spiteful slap at a competitor. It's not Google is really vulnerable to the same kind of thing, they've long since shown that the security of older versions of their only real public OS is not their concern.
    - a1369209993 7y ago
      > You forgot to include "with pre-built exploit tooling built around what he explicitly said he spent a lot of time on." No I didn't; I said everything and I meant everything. If anything, 90 days is overly generous to Google. If they can't get their shit together in three bloody months, fuck them. Of course, this is Google, so fuck them regardless, but this way you have obvious moral high ground.

tedunangst 7y ago

Perhaps there should be more heat on the competition. Microsoft could have found this problem as well, much easier even by reading their own internal documentation. They chose not to care.

Godel_unicode 7y ago

> looking at non-competing products with large user bases Like Linux? McAfee/Kaspersky/Malwarebytes/Symantec? LastPass? LG? Google's own software? Nvidia?