5 ms·

> They have no problems copping CVEs on competitors like Mozilla, Microsoft, or Apple.... but squirrel away zero days on their own products for the better part

> They have no problems copping CVEs on competitors like Mozilla, Microsoft, or Apple.... but squirrel away zero days on their own products for the better part of a year or more and then quietly publish blog posts without actually filing for a CVE. This comes up from time to time, but I'm not sure it's actually supported by the evidence, and maybe it's just random anecdotes from people that are consumed and then become opinion. Project Zero reports on Google vulnerabilities often, and in fact just made a post critical of Android's security practices.[1] I remember reading years back metrics on who they publish bugs about, and on looking, I see they published something earlier this year about the prior year in review[2] with data. It's really not hard to look some of this stuff up to see whether your feelings are supported by the data. Maybe this changes your opinion, maybe it doesn't, but at least you have some data to look at now. 1: https://arstechnica.com/gadgets/2022/11/google-says-google-should-do-a-better-job-of-patching-android-phones/ https://arstechnica.com/gadgets/2022/11/google-says-google-s... 2: https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html https://googleprojectzero.blogspot.com/2022/02/a-walk-throug...

zelon88 4y ago
ARS is a pretty pedestrian source. And your second source is Google, so take that with a grain of salt. Not only that, but it backs up my claim. They even admit in the article that IOS gets 7 times more bugs than Android because Google applies the Android methodology to IOS arbitrarily even though the two update philosophies aren't really compatible.
- kbenson 4y ago
  > ARS is a pretty pedestrian source. Are you discounting it because of the site name over the content? The Ars article just links to the Project Zero blog post (a very recent one). > And your second source is Google, so take that with a grain of salt. The Project Zero blog post I linked to is them reviewing their past submissions, and they provide a link to that, and review the data all you want. It's up to you to consider whether you think the researchers are hiding Google exploits, using this data, or other data, or other people's analysis, or just your own intuition. > Not only that, but it backs up my claim. They even admit in the article that IOS gets 7 times more bugs than Android because Google applies the Android methodology to IOS arbitrarily even though the two update philosophies aren't really compatible. What does that have to do with your claim that they "squirrel away zero days on their own products for the better part of a year or more and then quietly publish blog posts without actually filing for a CVE." ? Also, you're taking their admission along with the data that the numbers paint iOS worse than what the reality is as evidence of them being heavy handed against iOS? That's an interesting interpretation.

zelon88 4y ago

ARS is a pretty pedestrian source. And your second source is Google, so take that with a grain of salt. Not only that, but it backs up my claim. They even admit in the article that IOS gets 7 times more bugs than Android because Google applies the Android methodology to IOS arbitrarily even though the two update philosophies aren't really compatible.

kbenson 4y ago
> ARS is a pretty pedestrian source. Are you discounting it because of the site name over the content? The Ars article just links to the Project Zero blog post (a very recent one). > And your second source is Google, so take that with a grain of salt. The Project Zero blog post I linked to is them reviewing their past submissions, and they provide a link to that, and review the data all you want. It's up to you to consider whether you think the researchers are hiding Google exploits, using this data, or other data, or other people's analysis, or just your own intuition. > Not only that, but it backs up my claim. They even admit in the article that IOS gets 7 times more bugs than Android because Google applies the Android methodology to IOS arbitrarily even though the two update philosophies aren't really compatible. What does that have to do with your claim that they "squirrel away zero days on their own products for the better part of a year or more and then quietly publish blog posts without actually filing for a CVE." ? Also, you're taking their admission along with the data that the numbers paint iOS worse than what the reality is as evidence of them being heavy handed against iOS? That's an interesting interpretation.