3 ms·

I mean Google has this blog specifically to report on security vulnerabilities. That is literally like Volvo running a YT channel where they crash test cars fr

I mean Google has this blog specifically to report on security vulnerabilities. That is literally like Volvo running a YT channel where they crash test cars from other companies and assess the damage to the dummy. "In the name of safety." I'm not the one stretching here.

ziddoap 5y ago
Google's security team is doing exactly what everyone in the security industry considers a best practice: publicly disclosing vulnerabilities. However, since you're putting quotes around 'safety', I'll assume you must not be familiar with the fact that it is widely regarded as a best practice, and suggest you start with [0]. Out of curiosity, would you feel safer if the vulnerabilities Project Zero found were never found or fixed? Would you feel safer if they were found, but kept hidden so that other similar programs/libraries were unaware of the potential vulnerabilities? The only people that seem to be upset about this are those on HN and Reddit who use every excuse to get angry at Google, context be damned. Your analogy completely falls apart when you consider that Project Zero reports on their own products (by blog posts - Google: 24, Apple: 28, MS: 36). Make sure to consider the security footprint of the products offered between the three, as more footprint results in more bugs, and you'll see they (comparatively to the footprint) report on Google owned products quite frequently. A more apt analogy would be if crash safety experts at Volvo spun off their own crash test centre, loosely under the umbrella of Volvo, and tested all (including many Volvo made) available cars for safety then publicly reported the results, data, and methodology. Then they offer suggestions for all car manufacturers, including Volvo, on how to make their cars safer for use. Personally, I'd be just fine with that, too. [0] https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html https://www.schneier.com/essays/archives/2007/01/schneier_fu...

ziddoap 5y ago

Google's security team is doing exactly what everyone in the security industry considers a best practice: publicly disclosing vulnerabilities. However, since you're putting quotes around 'safety', I'll assume you must not be familiar with the fact that it is widely regarded as a best practice, and suggest you start with [0]. Out of curiosity, would you feel safer if the vulnerabilities Project Zero found were never found or fixed? Would you feel safer if they were found, but kept hidden so that other similar programs/libraries were unaware of the potential vulnerabilities? The only people that seem to be upset about this are those on HN and Reddit who use every excuse to get angry at Google, context be damned. Your analogy completely falls apart when you consider that Project Zero reports on their own products (by blog posts - Google: 24, Apple: 28, MS: 36). Make sure to consider the security footprint of the products offered between the three, as more footprint results in more bugs, and you'll see they (comparatively to the footprint) report on Google owned products quite frequently. A more apt analogy would be if crash safety experts at Volvo spun off their own crash test centre, loosely under the umbrella of Volvo, and tested all (including many Volvo made) available cars for safety then publicly reported the results, data, and methodology. Then they offer suggestions for all car manufacturers, including Volvo, on how to make their cars safer for use. Personally, I'd be just fine with that, too. [0] https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html https://www.schneier.com/essays/archives/2007/01/schneier_fu...