3 ms·
What information in the P0 blog posts on this topic was false or misleading? I read Apple's response, then I read the P0 blog post, but I don't see anything in
by ijpoijpoihpiuoh 7y ago
What information in the P0 blog posts on this topic was false or misleading? I read Apple's response, then I read the P0 blog post, but I don't see anything in Apple's response that actually rebuts anything that the P0 blog post said about this vulnerability.
Apple says "Google’s post ... creates the false impression of 'mass exploitation' to 'monitor the private activities of entire populations in real time,'". But Google's post doesn't do that. Those sentences occur late in the blog post, and aim to educate about the risks posed by software vulnerabilities in general, not these specific vulns. That is abundantly clear from the text. The only way to get the impression that Google was doing otherwise is to merely skim the post.
It seems like Apple is mostly annoyed that the press latched on to this, although honestly I question how much it matters since nobody seems to pay any lasting attention to these types of stories anyway.
- AgloeDreams 7y agoTimeline, Google said 2 years, Apple said 2 months.
- cromwellian 7y ago2 months for those particular websites. There's a difference between the timeline that a vulnerability existed, and the timeline of a specific known usage of them. Apple is trying to confuse the two. If I discover a security hole that's been present in Windows for 10 years, but only know of an active usage of it say, in the Ukraine by Russia, I'm going to say that the vulnerability is 10 years, not 2-months. 10 years is the length of time you could have been exposed. 2months, Ukraine, tells you how much more likely you were in danger for that location. But you should not act as if the vulnerability existing for 10 years didn't affect you, because you don't know about how many other people were using it.
- wintercharm 7y agoI think the point being made here is why are both numbers not disclosed, and only one was? I think both the time the bug existed and the relevant timeframe of known exploits should be part of a responsible security disclosure. Omitting either one is a disservice to users.