3 ms·

No, the official policy is that that team is to poke at anything that's used together with Google, which is ~everything. It started as a result of someone using

by Arnt 4y ago

No, the official policy is that that team is to poke at anything that's used together with Google, which is ~everything. It started as a result of someone using a security bug in other software to gain privileged access to Google. You have a phone. People use the same phone together with a Google service and a security-related bug in the phone could be used to e.g. steal your Google password, therefore the phone's software is in-scope, no matter who made it or what it runs. I see the sense of it, but it's weird to me too. What's not used together with Google? That's such a wide scope. But it's not a matter of security or marketing, the weirdness is in the wide usage. Kudos to Google for working on it.

agloe_dreams 4y ago
Exactly. A few months (or was it a year?) ago they had a 0-day on iOS that was fixed and made a huge stink about it and it all just read like marketing for a Pixel. It's a wide net that I'm still glad they do...just weird. IT does make me wonder...what...don't..they report? Why wouldn't they hold a few smaller items back, focus a little more on iOS exploits? It's just a "Be aware of the source" thought. Still a net positive.
- chatmasta 4y ago
  They find plenty of bugs in their own devices too. And it's not like they aren't responsibly disclosing to Apple. But I'd be curious how strictly their 90 day disclosure policy applies to Google products, and if they are more willing to grant some leeway when a fix isn't pushed in time...
  - Arnt 4y ago
    "Hi, maps team, you still haven't fixed foo and time is runnuing out. You may recall that Project Zero was founded because [name of founder] was livid about a security bug. Do you want to fix this RSN, or would you prefer to discuss it with him?"
  - Hizonner 4y ago
    They've been known to actually go public on Google stuff when other Google groups didn't get their shit together on time.

by Arnt 4y ago

agloe_dreams 4y ago

Exactly. A few months (or was it a year?) ago they had a 0-day on iOS that was fixed and made a huge stink about it and it all just read like marketing for a Pixel. It's a wide net that I'm still glad they do...just weird. IT does make me wonder...what...don't..they report? Why wouldn't they hold a few smaller items back, focus a little more on iOS exploits? It's just a "Be aware of the source" thought. Still a net positive.

chatmasta 4y ago
They find plenty of bugs in their own devices too. And it's not like they aren't responsibly disclosing to Apple. But I'd be curious how strictly their 90 day disclosure policy applies to Google products, and if they are more willing to grant some leeway when a fix isn't pushed in time...
- Arnt 4y ago
  "Hi, maps team, you still haven't fixed foo and time is runnuing out. You may recall that Project Zero was founded because [name of founder] was livid about a security bug. Do you want to fix this RSN, or would you prefer to discuss it with him?"
- Hizonner 4y ago
  They've been known to actually go public on Google stuff when other Google groups didn't get their shit together on time.