6 ms·

After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the ac

After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the accusation of non-Google bias. For those who hold this position, does this affect your stance?

GeekyBear 7y ago
Wasn't this a case where members of the Project Zero team were individually commenting in a Chromium bug thread and not a Project Zero public facing blog post? Was there a Project Zero blog post before those comments went public that I missed?
- fireattack 7y ago
  It's not a "Chromium" bug, it's project-zero bug [1]. https://bugs.chromium.org/ https://bugs.chromium.org/ is just a bug tracker site to host batch of projects by Google. While most of them are related to Chromium, there are also things like project-zero. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
  - GeekyBear 7y ago
    So where was the Project Zero blog post on the matter? Because if this wasn't announced on their blog I'm going to have to say that this particular case would not be an apples to apples comparison. Here was the Project Zero blog post on Apple's exploit, for comparison. https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
    - Thorrez 7y ago
      Note that that blog post was published in August 2019, while the vulnerabilities mentioned in the blog post were reported in a wide range of dates from October 2017[1] to December 2018[2] (that's the latest one I found in a quick skim, maybe there are later ones). This Android vulnerability was reported September 2019[3], so it may take 8-22 months before the blog post comes out. The reporter does intend to post a blog post about it[3]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1417 https://bugs.chromium.org/p/project-zero/issues/detail?id=14... [2] https://bugs.chromium.org/p/project-zero/issues/detail?id=1731 https://bugs.chromium.org/p/project-zero/issues/detail?id=17... [3] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
  - hermanradtke 7y ago
    They CNAME the site and give P0 a dedicated domain if they wanted to alleviate this confusion.
whycombagator 7y ago
I've not seen that criticism myself. But to me what Project Zero is doing re: Apple vulnerabilities is great. I own Apple products and it's only going to improve/harden them However, I do think some of the motive is to take a bit of shine off Apple - meaning it's partly a marketing campaign.
endorphone 7y ago
Their release pattern with the Apple fault could effectively be called a PR campaign, including a lot of editorial narrative about bad software development processes, etc. This one gets a bug tracker entry. When Project Zero posts a lengthy analysis with lots of scurious claims about the victims of the exploit, the window of exploitation, and narrative about the poor development practices that led to it, then call it even. If it follows the traditional pattern, they'll write a post blaming some external party. No, seriously, when people point out all of the "Android" faults they've found invariably it is some variation of "but it isn't really Google's fault....". Project Zero is brilliant, full of brilliant people, and is a remarkable effort, but when your paycheque is signed off by someone, it is human nature that you're really going to pussyfoot with them.
- Thorrez 7y ago
  >This one gets a bug tracker entry. For now. A comment from the reporter on the bug tracker entry: >A more detailed explanation of this bug and the methodology to identify it will be written up in a forthcoming blog post when I find the time.
  - oefrha 7y ago
    The iOS “deep dive” was a timed media push of a months-old problem right before a major Android release. They didn’t even try to obfuscate the timing or narrative. Blog post or not it’s pretty hard to top that.
    - deleted 7y ago
      [deleted]
    - panpanna 7y ago
      You are paranoid. Apple has started multiple keynotes by talking about Android security issues. Pointing fingers and ridiculing Google, Samsung and others. Then a few weeks later, a Google keynote would demo something on an iPad and praise its beautiful hi-def screen. I have _never_ heard Google officially talk crap about Apple.
kerng 7y ago
So far this further supports the argument that they are special casing and going into a lot more detail when it comes to non Android or Chrome bugs. Will there be a large analysis how frequently this was exploited and so forth? How about a public Google blog post around this?
- kerng 7y ago
  Oh, surprise Google fan boys/employees downvoting a critical post about the company without leaving a comment. How typical. This is getting boring on HN.
  - jsjohnst 7y ago
    https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - panpanna 7y ago
      Not related to parent post but I think those guidelines urgently need to be updated with rules about abuse of the flagging mechanism. I have had multiple HN posts flagged by people who wanted to reduce its visibility. (One happened on this very page)
thesausageking 7y ago
No. I may change my mind but the fact that they haven't written a blog post about it reinforces Project Zero's bias. A minor windows exploit is found, and they publish "Windows Exploitation Tricks". An iOS exploit is found and they do a six part "very deep dive into iOS Exploit chains". Now, they find a bad Android exploit and they don't publish anything.
deleted 7y ago
[deleted]

GeekyBear 7y ago

Wasn't this a case where members of the Project Zero team were individually commenting in a Chromium bug thread and not a Project Zero public facing blog post? Was there a Project Zero blog post before those comments went public that I missed?

fireattack 7y ago
It's not a "Chromium" bug, it's project-zero bug [1]. https://bugs.chromium.org/ https://bugs.chromium.org/ is just a bug tracker site to host batch of projects by Google. While most of them are related to Chromium, there are also things like project-zero. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
- GeekyBear 7y ago
  So where was the Project Zero blog post on the matter? Because if this wasn't announced on their blog I'm going to have to say that this particular case would not be an apples to apples comparison. Here was the Project Zero blog post on Apple's exploit, for comparison. https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
  - Thorrez 7y ago
    Note that that blog post was published in August 2019, while the vulnerabilities mentioned in the blog post were reported in a wide range of dates from October 2017[1] to December 2018[2] (that's the latest one I found in a quick skim, maybe there are later ones). This Android vulnerability was reported September 2019[3], so it may take 8-22 months before the blog post comes out. The reporter does intend to post a blog post about it[3]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1417 https://bugs.chromium.org/p/project-zero/issues/detail?id=14... [2] https://bugs.chromium.org/p/project-zero/issues/detail?id=1731 https://bugs.chromium.org/p/project-zero/issues/detail?id=17... [3] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
- hermanradtke 7y ago
  They CNAME the site and give P0 a dedicated domain if they wanted to alleviate this confusion.

whycombagator 7y ago

I've not seen that criticism myself. But to me what Project Zero is doing re: Apple vulnerabilities is great. I own Apple products and it's only going to improve/harden them However, I do think some of the motive is to take a bit of shine off Apple - meaning it's partly a marketing campaign.

endorphone 7y ago

Their release pattern with the Apple fault could effectively be called a PR campaign, including a lot of editorial narrative about bad software development processes, etc. This one gets a bug tracker entry. When Project Zero posts a lengthy analysis with lots of scurious claims about the victims of the exploit, the window of exploitation, and narrative about the poor development practices that led to it, then call it even. If it follows the traditional pattern, they'll write a post blaming some external party. No, seriously, when people point out all of the "Android" faults they've found invariably it is some variation of "but it isn't really Google's fault....". Project Zero is brilliant, full of brilliant people, and is a remarkable effort, but when your paycheque is signed off by someone, it is human nature that you're really going to pussyfoot with them.

Thorrez 7y ago
>This one gets a bug tracker entry. For now. A comment from the reporter on the bug tracker entry: >A more detailed explanation of this bug and the methodology to identify it will be written up in a forthcoming blog post when I find the time.
- oefrha 7y ago
  The iOS “deep dive” was a timed media push of a months-old problem right before a major Android release. They didn’t even try to obfuscate the timing or narrative. Blog post or not it’s pretty hard to top that.
  - deleted 7y ago
    [deleted]
  - panpanna 7y ago
    You are paranoid. Apple has started multiple keynotes by talking about Android security issues. Pointing fingers and ridiculing Google, Samsung and others. Then a few weeks later, a Google keynote would demo something on an iPad and praise its beautiful hi-def screen. I have _never_ heard Google officially talk crap about Apple.

kerng 7y ago

So far this further supports the argument that they are special casing and going into a lot more detail when it comes to non Android or Chrome bugs. Will there be a large analysis how frequently this was exploited and so forth? How about a public Google blog post around this?

kerng 7y ago
Oh, surprise Google fan boys/employees downvoting a critical post about the company without leaving a comment. How typical. This is getting boring on HN.
- jsjohnst 7y ago
  https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - panpanna 7y ago
    Not related to parent post but I think those guidelines urgently need to be updated with rules about abuse of the flagging mechanism. I have had multiple HN posts flagged by people who wanted to reduce its visibility. (One happened on this very page)

thesausageking 7y ago

No. I may change my mind but the fact that they haven't written a blog post about it reinforces Project Zero's bias. A minor windows exploit is found, and they publish "Windows Exploitation Tricks". An iOS exploit is found and they do a six part "very deep dive into iOS Exploit chains". Now, they find a bad Android exploit and they don't publish anything.

deleted 7y ago

[deleted]