4 ms·

To be precise, P0 is accused of focusing on finding bugs in competing products. This is a bug they were told about, not from original research.

tptacek 7y ago
... which is what vulnerability research teams are supposed to do, of course. Finding bugs in other people's products is, effectively, a donation to those projects. Google pays consultants many tens of thousands of dollars a pop to get the same work done for their own products.
- tedunangst 7y ago
  To be even more precise, I don't care how P0 spend their time. If people don't like them blowing up their products, make better products. But writing up an exploit that was basically handed to them is pretty weak evidence against the angry narrative.
  - moyix 7y ago
    Right, something like this page is better evidence against that narrative: https://bugs.chromium.org/p/project-zero/issues/list?q=Product%3DAndroid&can=1 https://bugs.chromium.org/p/project-zero/issues/list?q=Produ...
  - joshuamorton 7y ago
    The narrative seems to be both that p0 doesn't do research into Google's stuff, and that p0 doesn't post bulletins about vulns in Google's stuff. Both are untrue, but if you point out one, people flip to the other.
  - p1necone 7y ago
    The amount of work they put into finding issues isn't relevant though, it's the benefit google might be getting from other companies bad PR. So this situation still seems like a counterexample to me.
- deleted 7y ago
  [deleted]
- 2804t3qwp 7y ago
  It's only a donation if you assume the vulnerability is not cutting edge, otherwise it doesn't seem unfair to label the disclosure as corrosive to the current zeitgeist in terms of user safety. Just because you've managed to marry genuine research and politics doesn't mean that you've eliminated the more general bias produced by researching/disclosing information about opposing products more frequently than your own. At the same time, this also doesn't mean the system is bad, it could be entirely possible that the status quo of security without adversarial research is much worse for the end user.
  - tptacek 7y ago
    I don't know what any of this means. The vulnerabilities exist no matter who discovers them, and vulnerability discovery is a service every major vendor pays dearly for. If the optics of discovery are bad for Apple or Microsoft, Apple or Microsoft should spend more to keep from being one-upped by P0.
    - 2804t3qwp 7y ago
      From what you've said it seems like the difference is more an issue of framing. You're focused on the effects for the end user, which are the same no matter what in my opinion and I agree on that. At the same time, if you're publishing exploits that are cutting edge and primarily only apply to the competition then, because you (in this hypothetical) are a company, the overall effects of the research are self serving. Why not publish more vulnerabilities that apply to your own systems otherwise? Surely you (again, the hypothetical you) are in a better position than other entities to engage in introspective research that benefits the end user. Obviously there's a possibility that the explanation is "Because the competition has more flaws than our/my own product" but without evidence such is the case then there isn't a lot of reason for outside critics to give the benefit of the doubt. Also, I'm not a security researcher so I realize some of my points might not be accurate to the state of the industry. I'm moreso trying to highlight the lines of thinking that lead to criticism of P0 and why I don't think they're easy to refute without a certain degree of burden on Google's/Totallyrelatedbutnot-google's part.

tptacek 7y ago

... which is what vulnerability research teams are supposed to do, of course. Finding bugs in other people's products is, effectively, a donation to those projects. Google pays consultants many tens of thousands of dollars a pop to get the same work done for their own products.

tedunangst 7y ago
To be even more precise, I don't care how P0 spend their time. If people don't like them blowing up their products, make better products. But writing up an exploit that was basically handed to them is pretty weak evidence against the angry narrative.
- moyix 7y ago
  Right, something like this page is better evidence against that narrative: https://bugs.chromium.org/p/project-zero/issues/list?q=Product%3DAndroid&can=1 https://bugs.chromium.org/p/project-zero/issues/list?q=Produ...
- joshuamorton 7y ago
  The narrative seems to be both that p0 doesn't do research into Google's stuff, and that p0 doesn't post bulletins about vulns in Google's stuff. Both are untrue, but if you point out one, people flip to the other.
- p1necone 7y ago
  The amount of work they put into finding issues isn't relevant though, it's the benefit google might be getting from other companies bad PR. So this situation still seems like a counterexample to me.
deleted 7y ago
[deleted]
2804t3qwp 7y ago
It's only a donation if you assume the vulnerability is not cutting edge, otherwise it doesn't seem unfair to label the disclosure as corrosive to the current zeitgeist in terms of user safety. Just because you've managed to marry genuine research and politics doesn't mean that you've eliminated the more general bias produced by researching/disclosing information about opposing products more frequently than your own. At the same time, this also doesn't mean the system is bad, it could be entirely possible that the status quo of security without adversarial research is much worse for the end user.
- tptacek 7y ago
  I don't know what any of this means. The vulnerabilities exist no matter who discovers them, and vulnerability discovery is a service every major vendor pays dearly for. If the optics of discovery are bad for Apple or Microsoft, Apple or Microsoft should spend more to keep from being one-upped by P0.
  - 2804t3qwp 7y ago
    From what you've said it seems like the difference is more an issue of framing. You're focused on the effects for the end user, which are the same no matter what in my opinion and I agree on that. At the same time, if you're publishing exploits that are cutting edge and primarily only apply to the competition then, because you (in this hypothetical) are a company, the overall effects of the research are self serving. Why not publish more vulnerabilities that apply to your own systems otherwise? Surely you (again, the hypothetical you) are in a better position than other entities to engage in introspective research that benefits the end user. Obviously there's a possibility that the explanation is "Because the competition has more flaws than our/my own product" but without evidence such is the case then there isn't a lot of reason for outside critics to give the benefit of the doubt. Also, I'm not a security researcher so I realize some of my points might not be accurate to the state of the industry. I'm moreso trying to highlight the lines of thinking that lead to criticism of P0 and why I don't think they're easy to refute without a certain degree of burden on Google's/Totallyrelatedbutnot-google's part.