4 ms·

There are many parts of Google that I won't rise to defend, but to preempt the inevitable: Project Zero does disclose Google issues on the same basis as anyone

• tptacek 4y ago
  It wouldn't matter if they didn't. Research and disclosure of vulnerabilities is an absolute good; they don't need to earn the right to publish bugs (it's closer to the other way around).
  • halJordan 4y ago
    This mentality is becoming passé. And frankly this article/post is a good example of the reason. It was long thought that you could name & shame people into good security, but it turns out they just purchase cyber insurance and retreat deeper into the shadows, which increases exposure to the end user. But the new reality is that malicious uptake on publicized POCs is so great, and the negligent refusal to patch is so great that a widespread culture of reporting has actually increased harm to the public. That is the reality, and until there are laws that hold companies liable for the software they choose it will remain the case.
    • tptacek 4y ago
      I came up in an era of CERT's anti-disclosure regime, with no auto-update anywhere, and there is simply no comparison. No, to all of what you said; I don't think I could disagree with anything more strongly.
• wolverine876 4y ago
  You don't know what issues they withheld.