5 ms·

Completely agreed. Security is a collaborative endeavor. Project Zero was not accusatory and did not over-hype the scope of the vulnerability. Project Zero is

Completely agreed. Security is a collaborative endeavor. Project Zero was not accusatory and did not over-hype the scope of the vulnerability. Project Zero is an amazing team that has only helped the state of security worldwide. Apple's defensive and accusatory response makes zero sense and goes against the very spirit of security today.

pjmlp 7y ago
Pity that they miss Android bugs. https://arstechnica.com/information-technology/2019/09/android-zeroday-gives-hackers-a-way-to-elevate-attacks/ https://arstechnica.com/information-technology/2019/09/andro...
- monocasa 7y ago
  https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl... They have no problem covering Android bugs, they just don't write about bugs they didn't find.
  - outside1234 7y ago
    That just seems too super convenient to me. Why would they not laser focused on Android bugs? I suspect they are, but backchannel them to the development team, versus airing them.
    - monocasa 7y ago
      They're some of the top security researchers in the world and are given autonomy is why. Which is what the security community has settled on being the right incentive structure when optimizing for end user security.
    - asveikau 7y ago
      In the case of these recent iOS bugs, they didn't "air them" until after the fix was released. So any "back channel", if you could call it that, seems to exist for Apple too.
  - deleted 7y ago
    [deleted]
- Despegar 7y ago
  >ZDI's Wednesday post said researchers notified Google of the vulnerability in mid-March and that by the end of June, the company had confirmed that the flaw would be fixed. When ZDI asked Google for an update last month, Google responded there would be no further updates. Google released the Android Security Bulletin for September on Tuesday, and the flaw still wasn't fixed. Google didn't respond to a request for comment.
  - jsgo 7y ago
    If that's true, that's interesting. Because there have been cases where vendors have asked Google for more time to vet a fix that was going to lapse the responsible disclosure's window and Google (or perhaps more specifically, Project Zero) wouldn't allow it. Mid-March to end of June is a bit over 90 days at my estimation (depending on specific dates, obviously) and yet by September nothing and no updates.
    - makomk 7y ago
      The ZDI disclosure is rather vague, but I suspect this is a vendor-specific vulnerability and the speculation otherwise in the Ars Technica article is just wrong. There is no single "v4l2 driver" used by across all of Android - every device has its own v4l2 driver with its own implementation of the userland-facing v4l2 APIs, and vendors being what they are some of them are of pretty poor quality.

pjmlp 7y ago

Pity that they miss Android bugs. https://arstechnica.com/information-technology/2019/09/android-zeroday-gives-hackers-a-way-to-elevate-attacks/ https://arstechnica.com/information-technology/2019/09/andro...

monocasa 7y ago
https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl... They have no problem covering Android bugs, they just don't write about bugs they didn't find.
- outside1234 7y ago
  That just seems too super convenient to me. Why would they not laser focused on Android bugs? I suspect they are, but backchannel them to the development team, versus airing them.
  - monocasa 7y ago
    They're some of the top security researchers in the world and are given autonomy is why. Which is what the security community has settled on being the right incentive structure when optimizing for end user security.
  - asveikau 7y ago
    In the case of these recent iOS bugs, they didn't "air them" until after the fix was released. So any "back channel", if you could call it that, seems to exist for Apple too.
- deleted 7y ago
  [deleted]
Despegar 7y ago
>ZDI's Wednesday post said researchers notified Google of the vulnerability in mid-March and that by the end of June, the company had confirmed that the flaw would be fixed. When ZDI asked Google for an update last month, Google responded there would be no further updates. Google released the Android Security Bulletin for September on Tuesday, and the flaw still wasn't fixed. Google didn't respond to a request for comment.
- jsgo 7y ago
  If that's true, that's interesting. Because there have been cases where vendors have asked Google for more time to vet a fix that was going to lapse the responsible disclosure's window and Google (or perhaps more specifically, Project Zero) wouldn't allow it. Mid-March to end of June is a bit over 90 days at my estimation (depending on specific dates, obviously) and yet by September nothing and no updates.
  - makomk 7y ago
    The ZDI disclosure is rather vague, but I suspect this is a vendor-specific vulnerability and the speculation otherwise in the Ars Technica article is just wrong. There is no single "v4l2 driver" used by across all of Android - every device has its own v4l2 driver with its own implementation of the userland-facing v4l2 APIs, and vendors being what they are some of them are of pretty poor quality.