4 ms·
I think the article was advocating more for not disclosing the vulnerabilities and silently patching them. So the vuln goes away but no fingers are pointed. Wh
by wepple 6y ago
I think the article was advocating more for not disclosing the vulnerabilities and silently patching them. So the vuln goes away but no fingers are pointed.
Which is also a silly argument; enough security researchers will watch the updates/patches and immediately spot the vulnerabilities, then accuse Google of brushing it under the carpet and being in bed with govt.
Not patching is not doable.
Patching silently is not doable.
Vendors should do what google did. All of them.
- unishark 6y agoIt was a long and meandering article that seemed to be fishing around for every possibly related controversy it could find (and it worked, look at all the people talking about the article). But Google's blog post weren't just about the vulnerabilities so much as the hacking operation, which had exploited multiple different vulnerabilities. As for publicizing the operation itself, which was the real controversial decision, they went halfway on it, by holding back key details. https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i...