4 ms·

Exactly. So why is Google pushing a presser about Apple "not reporting a zero day" when they have a team (Project Zero) dedicated to discovery of zero days? Is

Exactly. So why is Google pushing a presser about Apple "not reporting a zero day" when they have a team (Project Zero) dedicated to discovery of zero days? Is it really that Apple employee's responsibility, or is it Google Project Zero employee's responsibility?

verdverm 3y ago
It's everybody's responsibility to make a safer world. project zero researches vulns in their competitors and responsibly reports them. So why is Apple not reporting vulns to others when others are reporting to them?
- gumby 3y ago
  > So why is Apple not reporting vulns to others when others are reporting to them? The article includes an explanation. It seems plausible.
  - verdverm 3y ago
    almost 3 months to find the right person, get the signatures, and deal with OOO Meanwhile another person reported in a timely manner. plausible versus reasonable?
    - gumby 3y ago
      This is apple we're talking about. Some times magnificent, other (most?) times unable to get out of its own way, especially when it doesn't have a process for X. And anything that involves saying anything in public... Obviously they think their silos of secrecy are a net positive, but really I wonder. I do consider them the greatest, or one of the greatest execution machines in business, but I also think that's despite themselves.
- scrum-treats 3y ago
  > It's everybody's responsibility to make a safer world. > project zero researches vulns in their competitors and responsibly reports them. I agree. Project Zero is a talented group.
LargeTomato 3y ago
No one is perfect. No organization is perfect. US tech companies actively collaborate to improve security.
lesuorac 3y ago
Google doesn't run TechCrunch .... The best you can do is say Google says "this issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022, which will be acknowledged in the security fix notes for the appropriate Stable channel release at the time they are updated" [1] which really is a nothingburger. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786...
someplaceguy 3y ago
I'm confused. Are you suggesting that having a team dedicated to discovering zero days means that this team will discover all zero days that could possibly exist? Or even, that they will discover all zero days that will be discovered before anyone else discovers them?

verdverm 3y ago

It's everybody's responsibility to make a safer world. project zero researches vulns in their competitors and responsibly reports them. So why is Apple not reporting vulns to others when others are reporting to them?

gumby 3y ago
> So why is Apple not reporting vulns to others when others are reporting to them? The article includes an explanation. It seems plausible.
- verdverm 3y ago
  almost 3 months to find the right person, get the signatures, and deal with OOO Meanwhile another person reported in a timely manner. plausible versus reasonable?
  - gumby 3y ago
    This is apple we're talking about. Some times magnificent, other (most?) times unable to get out of its own way, especially when it doesn't have a process for X. And anything that involves saying anything in public... Obviously they think their silos of secrecy are a net positive, but really I wonder. I do consider them the greatest, or one of the greatest execution machines in business, but I also think that's despite themselves.
scrum-treats 3y ago
> It's everybody's responsibility to make a safer world. > project zero researches vulns in their competitors and responsibly reports them. I agree. Project Zero is a talented group.

LargeTomato 3y ago

No one is perfect. No organization is perfect. US tech companies actively collaborate to improve security.

lesuorac 3y ago

Google doesn't run TechCrunch .... The best you can do is say Google says "this issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022, which will be acknowledged in the security fix notes for the appropriate Stable channel release at the time they are updated" [1] which really is a nothingburger. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786...

someplaceguy 3y ago

I'm confused. Are you suggesting that having a team dedicated to discovering zero days means that this team will discover all zero days that could possibly exist? Or even, that they will discover all zero days that will be discovered before anyone else discovers them?