4 ms·

I'm sure they thanked in private, but once you start going to press with false information the good will is dead. The fact of the matter is that while Project Z

I'm sure they thanked in private, but once you start going to press with false information the good will is dead. The fact of the matter is that while Project Zero might be good for the general population; its most good for Google who stands to gain from bad press of their competitors.

ijpoijpoihpiuoh 7y ago
What information in the P0 blog posts on this topic was false or misleading? I read Apple's response, then I read the P0 blog post, but I don't see anything in Apple's response that actually rebuts anything that the P0 blog post said about this vulnerability. Apple says "Google’s post ... creates the false impression of 'mass exploitation' to 'monitor the private activities of entire populations in real time,'". But Google's post doesn't do that. Those sentences occur late in the blog post, and aim to educate about the risks posed by software vulnerabilities in general, not these specific vulns. That is abundantly clear from the text. The only way to get the impression that Google was doing otherwise is to merely skim the post. It seems like Apple is mostly annoyed that the press latched on to this, although honestly I question how much it matters since nobody seems to pay any lasting attention to these types of stories anyway.
- AgloeDreams 7y ago
  Timeline, Google said 2 years, Apple said 2 months.
  - cromwellian 7y ago
    2 months for those particular websites. There's a difference between the timeline that a vulnerability existed, and the timeline of a specific known usage of them. Apple is trying to confuse the two. If I discover a security hole that's been present in Windows for 10 years, but only know of an active usage of it say, in the Ukraine by Russia, I'm going to say that the vulnerability is 10 years, not 2-months. 10 years is the length of time you could have been exposed. 2months, Ukraine, tells you how much more likely you were in danger for that location. But you should not act as if the vulnerability existing for 10 years didn't affect you, because you don't know about how many other people were using it.
    - wintercharm 7y ago
      I think the point being made here is why are both numbers not disclosed, and only one was? I think both the time the bug existed and the relevant timeframe of known exploits should be part of a responsible security disclosure. Omitting either one is a disservice to users.
elicash 7y ago
What I'm suggesting is that it scares me a bit, as an Apple user, to see Apple acting in such a hostile way PUBLICLY to a party letting them know about a security issue. I understand where they're coming from -- as I said, I also found the facts in their message useful for understanding the situation. The original headlines gave me a very different impression than what the facts seem to indicate happened. But as a PR piece, which is what this was, Apple needs to keep in mind that they want to project how much they ENCOURAGE folks reporting security issues to them. Sounding defensive is not helpful to them in that regard. Not everybody is Google. Will the next person be scared to report their findings because they think Apple will come after them rather than be appreciative simply because they don't approve of how it was framed? I'm not suggesting this is easy, only that as a PR matter it's probably best for Apple to take the high road even when their competition is being unfair. Correct falsehoods, yes, but the tone was off here.
- Despegar 7y ago
  Apple credits people who report vulnerabilities after every update. There are no public comments from Apple aside from those routine acknowledgements. Apple patched this within days of finding out about it. This press release is about everything other than the strictly business aspect of reporting and fixing a flaw.
wbl 7y ago
What fact was false in the P0 article? Apple is downplaying the severity of hacking thousands of people a day and sending them to concentration camps as a result.

ijpoijpoihpiuoh 7y ago

What information in the P0 blog posts on this topic was false or misleading? I read Apple's response, then I read the P0 blog post, but I don't see anything in Apple's response that actually rebuts anything that the P0 blog post said about this vulnerability. Apple says "Google’s post ... creates the false impression of 'mass exploitation' to 'monitor the private activities of entire populations in real time,'". But Google's post doesn't do that. Those sentences occur late in the blog post, and aim to educate about the risks posed by software vulnerabilities in general, not these specific vulns. That is abundantly clear from the text. The only way to get the impression that Google was doing otherwise is to merely skim the post. It seems like Apple is mostly annoyed that the press latched on to this, although honestly I question how much it matters since nobody seems to pay any lasting attention to these types of stories anyway.

AgloeDreams 7y ago
Timeline, Google said 2 years, Apple said 2 months.
- cromwellian 7y ago
  2 months for those particular websites. There's a difference between the timeline that a vulnerability existed, and the timeline of a specific known usage of them. Apple is trying to confuse the two. If I discover a security hole that's been present in Windows for 10 years, but only know of an active usage of it say, in the Ukraine by Russia, I'm going to say that the vulnerability is 10 years, not 2-months. 10 years is the length of time you could have been exposed. 2months, Ukraine, tells you how much more likely you were in danger for that location. But you should not act as if the vulnerability existing for 10 years didn't affect you, because you don't know about how many other people were using it.
  - wintercharm 7y ago
    I think the point being made here is why are both numbers not disclosed, and only one was? I think both the time the bug existed and the relevant timeframe of known exploits should be part of a responsible security disclosure. Omitting either one is a disservice to users.

elicash 7y ago

What I'm suggesting is that it scares me a bit, as an Apple user, to see Apple acting in such a hostile way PUBLICLY to a party letting them know about a security issue. I understand where they're coming from -- as I said, I also found the facts in their message useful for understanding the situation. The original headlines gave me a very different impression than what the facts seem to indicate happened. But as a PR piece, which is what this was, Apple needs to keep in mind that they want to project how much they ENCOURAGE folks reporting security issues to them. Sounding defensive is not helpful to them in that regard. Not everybody is Google. Will the next person be scared to report their findings because they think Apple will come after them rather than be appreciative simply because they don't approve of how it was framed? I'm not suggesting this is easy, only that as a PR matter it's probably best for Apple to take the high road even when their competition is being unfair. Correct falsehoods, yes, but the tone was off here.

Despegar 7y ago
Apple credits people who report vulnerabilities after every update. There are no public comments from Apple aside from those routine acknowledgements. Apple patched this within days of finding out about it. This press release is about everything other than the strictly business aspect of reporting and fixing a flaw.

wbl 7y ago

What fact was false in the P0 article? Apple is downplaying the severity of hacking thousands of people a day and sending them to concentration camps as a result.