4 ms·

This is a fantastic argument for the universe where Google does not disclose vulnerability until the maintainers had had reasonable time to fix it. In this wor

by afiori 11mo ago

This is a fantastic argument for the universe where Google does not disclose vulnerability until the maintainers had had reasonable time to fix it. In this world the user is left vulnerable because attackers can use published vulnerabilities that the maintainers are to overwhelmed to fix

esrauch 11mo ago
This program discloses security issues to the projects and only discloses them after they have had a "reasonable" chance to fix it though, and projects can request extensions before disclosure if projects plan to fix it but need more time. Google runs this security program even on libraries they do not use at all, where it's not a demand, it's just whitehat security auditing. I don't see the meaningful difference between Google doing it and some guy with a blog doing it here.
- XorNot 11mo ago
  Google is a multi-billion dollar company, which is paying people to find these bugs in the first place. That's a pretty core difference.
  - thevillagechief 11mo ago
    Corporate Social Responsibility? The assumption is that the work is good for end users. I don't know if that's the case for the maintainers though.
  - tpmoney 11mo ago
    Great, so Google is actively spending money on making open source projects better and more secure. And for some reason everyone is now mad at them for it because they didn't also spend additional money making patches themselves. We can absolutely wish and ask that they spend some money and resources on making those patches, but this whole thing feels like the message most corporations are going to take is "don't do anything to contribute to open source projects at all, because if you don't do it just right, they're going to drag you through the mud for it" rather than "submit more patches"
    - khannn 11mo ago
      They're actively making open source projects less secure by publishing bugs that the projects don't have the volunteers to fix I saw another poster say something about "buggy software". All software is buggy.
      - saagarjha 11mo ago
        Publishing bugs that the project has so that they can be fixed is actively making the project more secure. How is someone going to do anything about it if Google didn’t do the research?
        khannn 11mo ago
        Did you see how the FFMPEG project patched a bug for a 1995 console? That's not a good use for the limited amount of volunteers on the project. It actively makes it less secure by taking away from more pertinent bugs.
        saagarjha 11mo ago
        Then they should mark it as low priority and put it in their backlog. I trust that the maintainers are good judges of what deserves their time.
        XorNot 11mo ago
        Publicizing vulnerabilities is the problem though. Google is ensuring obscure or unknown vulnerabilities will now be very well known and very public. This is significant when they represent one of the few entities on the planet likely able to find bugs at that scale due to their wealth. So funding a swarm of bug reports, for software they benefit from, using a scale of resources not commonly available, while not contributing fixes and instead demanding timelines for disclosure, seems a lot more like they'd just like to drive people out of open source.
        11mo ago
toast0 11mo ago
The user is vulnerable while the problem is unfixed. Google publishing a vulnerability doesn't change the existence of the vulnerability. If Google can find it, so can others. Making the vulnerability public makes it easy to find to exploit, but it also makes it easy to find to fix.
- tremon 11mo ago
  If it is so easy to fix, then why doesn't Google fix it? So far they've spent more effort in spreading knowledge about the vulnerability than fixing it, so I don't agree with your assessment that Google is not actively making the world worse here.
  - toast0 11mo ago
    I didn't say it was easy to fix. I said a publication made it easy to find it, if someone wanted to fix something. If you want to fix up old codecs in ffmpeg for fun, would you rather have a list of known broken codecs and what they're doing wrong; or would you rather have to find a broken codec first.
- nmz 11mo ago
  > If Google can find it, so can others. While true, Only Google has google infrastructure, this presupposes that 100% of all published exploits would be findable.
  - chii 11mo ago
    you'd assume that a bad actor would have found the exploit and kept it hidden for their own use. To assume otherwise is fundamentally flawed security practice.
- BobaFloutist 11mo ago
  >If Google can find it, so can others. What a strange sentence. Google can do a lot of things that nobody can do. The list of things that only Google, a handful of nation states, and a handful of Google-peers can do is probably even longer.
om2 11mo ago
In this world and the alternate universe both, attackers can also use _un_published vulnerabilities because they have high incentive to do research. Keeping a bug secret does not prevent it from existing or from being exploited.

by afiori 11mo ago

esrauch 11mo ago

This program discloses security issues to the projects and only discloses them after they have had a "reasonable" chance to fix it though, and projects can request extensions before disclosure if projects plan to fix it but need more time. Google runs this security program even on libraries they do not use at all, where it's not a demand, it's just whitehat security auditing. I don't see the meaningful difference between Google doing it and some guy with a blog doing it here.

XorNot 11mo ago
Google is a multi-billion dollar company, which is paying people to find these bugs in the first place. That's a pretty core difference.
- thevillagechief 11mo ago
  Corporate Social Responsibility? The assumption is that the work is good for end users. I don't know if that's the case for the maintainers though.
- tpmoney 11mo ago
  Great, so Google is actively spending money on making open source projects better and more secure. And for some reason everyone is now mad at them for it because they didn't also spend additional money making patches themselves. We can absolutely wish and ask that they spend some money and resources on making those patches, but this whole thing feels like the message most corporations are going to take is "don't do anything to contribute to open source projects at all, because if you don't do it just right, they're going to drag you through the mud for it" rather than "submit more patches"
  - khannn 11mo ago
    They're actively making open source projects less secure by publishing bugs that the projects don't have the volunteers to fix I saw another poster say something about "buggy software". All software is buggy.
    - saagarjha 11mo ago
      Publishing bugs that the project has so that they can be fixed is actively making the project more secure. How is someone going to do anything about it if Google didn’t do the research?
      - khannn 11mo ago
        Did you see how the FFMPEG project patched a bug for a 1995 console? That's not a good use for the limited amount of volunteers on the project. It actively makes it less secure by taking away from more pertinent bugs.
        saagarjha 11mo ago
        Then they should mark it as low priority and put it in their backlog. I trust that the maintainers are good judges of what deserves their time.
        XorNot 11mo ago
        Publicizing vulnerabilities is the problem though. Google is ensuring obscure or unknown vulnerabilities will now be very well known and very public. This is significant when they represent one of the few entities on the planet likely able to find bugs at that scale due to their wealth. So funding a swarm of bug reports, for software they benefit from, using a scale of resources not commonly available, while not contributing fixes and instead demanding timelines for disclosure, seems a lot more like they'd just like to drive people out of open source.
        11mo ago

toast0 11mo ago

The user is vulnerable while the problem is unfixed. Google publishing a vulnerability doesn't change the existence of the vulnerability. If Google can find it, so can others. Making the vulnerability public makes it easy to find to exploit, but it also makes it easy to find to fix.

tremon 11mo ago
If it is so easy to fix, then why doesn't Google fix it? So far they've spent more effort in spreading knowledge about the vulnerability than fixing it, so I don't agree with your assessment that Google is not actively making the world worse here.
- toast0 11mo ago
  I didn't say it was easy to fix. I said a publication made it easy to find it, if someone wanted to fix something. If you want to fix up old codecs in ffmpeg for fun, would you rather have a list of known broken codecs and what they're doing wrong; or would you rather have to find a broken codec first.
nmz 11mo ago
> If Google can find it, so can others. While true, Only Google has google infrastructure, this presupposes that 100% of all published exploits would be findable.
- chii 11mo ago
  you'd assume that a bad actor would have found the exploit and kept it hidden for their own use. To assume otherwise is fundamentally flawed security practice.
BobaFloutist 11mo ago
>If Google can find it, so can others. What a strange sentence. Google can do a lot of things that nobody can do. The list of things that only Google, a handful of nation states, and a handful of Google-peers can do is probably even longer.

om2 11mo ago

In this world and the alternate universe both, attackers can also use _un_published vulnerabilities because they have high incentive to do research. Keeping a bug secret does not prevent it from existing or from being exploited.