3 ms·

I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/is

I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed: product=Android returns 81 results product=iOS returns 58 vendor=Apple returns 380 vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately) vendor=Linux return 54 To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products (Google lacks a desktop OS and an iMessage equivalent, for example), and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.

zepto 6y ago
I wonder what the numbers are like for these published blog posts?
- albntomat0 6y ago
  Super rough numbers. I counted posts in a series as 1 overall entry. Google: 24 Apple: 28 Microsoft: 36 Posts of Apple products seem to be more frequent in recent reporting, fwiw.
toast0 6y ago
> Google lacks a desktop OS and an iMessage equivalent, for example Nitpicking, but Chrome OS is a desktop OS, and Google has had at least 7 things similar to iMessage. On topic, fron my perspective when I was working somewhere that got bug reports from project zero, it was great. I mean, not great that we had the bug they found first, or the follow-up bug they found after we fixed that one; but great that they were clear problems that we could solve. If we didn't want to be written up, we could have done better to begin with, and taken more care in looking around when the first bug was reported.
- albntomat0 6y ago
  > Chrome OS Is Chrome OS sufficiently unique enough from Linux to be its own category (genuinely asking)? I was aware of it when I made the original comment, but considered it more a subset of Linux, in that most major kernel security bugs would be shared. Also, what are you considering similar to iMessage? My view is that iMessage presents its own unique & powerful attack surface that hangouts/etc dont have. Maybe RCS?
  - toast0 6y ago
    I think Chrome OS at least has a unique libc and GUI stack versus normal desktop Linux distributions? And there's certainly room for errors in their updater stack and all that. gChat, Allo, Duo, SMS (whatever it's called today), Hangouts, Meet, ??? They're all relatively similar, send messages including media (remember stagefright)
    - albntomat0 6y ago
      > gChat, Allo, Duo, SMS (whatever it's called today), Hangouts, Meet, ??? They're all relatively similar, send messages including media (remember stagefright) Most of those have a much more limited attack surface than iMessage, at least in my understanding. SMS is shared and doesn't try to do what iMessage does, thus the issues

zepto 6y ago

I wonder what the numbers are like for these published blog posts?

albntomat0 6y ago
Super rough numbers. I counted posts in a series as 1 overall entry. Google: 24 Apple: 28 Microsoft: 36 Posts of Apple products seem to be more frequent in recent reporting, fwiw.

toast0 6y ago

> Google lacks a desktop OS and an iMessage equivalent, for example Nitpicking, but Chrome OS is a desktop OS, and Google has had at least 7 things similar to iMessage. On topic, fron my perspective when I was working somewhere that got bug reports from project zero, it was great. I mean, not great that we had the bug they found first, or the follow-up bug they found after we fixed that one; but great that they were clear problems that we could solve. If we didn't want to be written up, we could have done better to begin with, and taken more care in looking around when the first bug was reported.

albntomat0 6y ago
> Chrome OS Is Chrome OS sufficiently unique enough from Linux to be its own category (genuinely asking)? I was aware of it when I made the original comment, but considered it more a subset of Linux, in that most major kernel security bugs would be shared. Also, what are you considering similar to iMessage? My view is that iMessage presents its own unique & powerful attack surface that hangouts/etc dont have. Maybe RCS?
- toast0 6y ago
  I think Chrome OS at least has a unique libc and GUI stack versus normal desktop Linux distributions? And there's certainly room for errors in their updater stack and all that. gChat, Allo, Duo, SMS (whatever it's called today), Hangouts, Meet, ??? They're all relatively similar, send messages including media (remember stagefright)
  - albntomat0 6y ago
    > gChat, Allo, Duo, SMS (whatever it's called today), Hangouts, Meet, ??? They're all relatively similar, send messages including media (remember stagefright) Most of those have a much more limited attack surface than iMessage, at least in my understanding. SMS is shared and doesn't try to do what iMessage does, thus the issues