4 ms·
To reiterate (1) The security problem existed for more than a week. (2) Google's post makes no mention of (1). Instead it talks about how the issue didn't imp
by credo 16y ago
To reiterate
(1) The security problem existed for more than a week.
(2) Google's post makes no mention of (1). Instead it talks about how the issue didn't impact certain Android versions and about how they removed the malicious apps "within minutes"
Regardless of your views on how many i's you'd like dotted and how many ts you'd like crossed for a DMCA form, ...... do you think that a "security update" post should suppress information about the duration of the security problem and just talk about "Within minutes of becoming aware" ?
- deleted 16y ago[deleted]
- trotsky 16y agoI guess I just don't read it the same way. Maybe it's just because I already knew about the issue, but it seems obvious the security issue existed before they were informed of it. A security issue that was fixed within minutes of its creation wouldn't be getting device wiped, cleaners pushed, market changes made. When you get security alerts from other vendors, do yours typically include the first known date of vulnerability or do they include the date it was first reported, or just the CVE assignment date? When redhat/apple/microsoft push a security update do they list the sites or programs that were known to be abusing the bugs? Not that I've seen. Hell it is rare to see anyone even listing the first date that they were being actively exploited. All of that would be better, of course, but it hardly seems reasonable to call google out when they're acting at least as responsibly as all their competitors.
- deleted 16y ago[deleted]