3 ms·

Well, the implication (and I'm not saying this is right) is that to Google it's only worth $1k to have this brought to their attention by a white hat, versus fi

Well, the implication (and I'm not saying this is right) is that to Google it's only worth $1k to have this brought to their attention by a white hat, versus finding out by exploitation. Which means that they have zero concern from this incident about reputational damage to themselves or their browser. That's pretty good circumstantial evidence of a monopolistic practice, when you can safely assume that there's effectively no difference to your bottom line if your software is hacked.

kccqzy 2mo ago
That’s exactly right, and applies to more than Google. I can’t think of a single browser vendor that would think a single vulnerability materially causes reputational damage.
thayne 2mo ago
But google is also a monopsony. There isn't anyone else the researcher can ethically sell it to. They just have to take whatever bounty google decides to pay.
- noduerme 2mo ago
  I'm just saying it's more evidence that Google should be broken up.
  - xnx 2mo ago
    How would you break up Google that would make browsers more secure?
    - ruszki 2mo ago
      Google should have been split up into shreds like 2 decades ago. Search wants to have income from ads? Good sell it to anybody who pays the most, just like every single newspaper does. Gmail wants to sell our data, or ad space? Good sell them, and not just reuse them internally. Chrome wants to monetize every single request you do? Go, sell them on the open market. And not this fake, "we're separate companies, but only on paper" way. This should have been done a long time ago. Firefox, and the browser market would be much more healthy. Btw, Microsoft, Apple, Facebook, now even Twitter/SpaceX and all of these should have been forced the same way. And of course not just in this field, but all of them, like oil companies. They can pivot, of course, with some grace period, but that would mean giving up something at the end. And if we are there, we can abolish most of trade secrecy too, which exists only to keep up the status quo while hindering progress.
      - WarmWash 2mo ago
        Google is the answer to an Internet that largely blocks ads and uses backdoors to circumvent pay walls. A single massive pillar with enough surface area to carry all the dead weight. If people want a better internet, they can start fostering one, rather than endlessly complain that someone else should be fostering it for them. There will probably be upwards of 1000 people who read this comment that have used Google services for 15+ years, never loaded a single ad, and complain about Google ruining the internet. Please, pick-up a mirror. Nobody wants to build a competitor to serve your cheap ass
        deleted 2mo ago
        [deleted]
        sire-vc 1mo ago
        I dont like ads. Would you be willing to pay for content? Obviously not, stupid. This comment in general, not aimed at you.
        genxy 1mo ago
        I pay for email and search. There are hundreds of us, hundreds.
        aka-rider 1mo ago
        Google is routinely buying and destroying competitors. They lower prices to kill competition en-masse. They promote their own products in search and elsewhere over paid ads. Search Engine have chicken and egg problem, you can only have a good search if enough people use it to tune the ranking and see enough search spam cases. “Just compete with a monopoly on their own field with one hand tied behind”
        WarmWash 1mo ago
        Every Google competitor has the problem that 40% of users won't load ads and 99% won't pay a subscription. They don't need to do anything adversarial, the greed driven mindset of the internet (ads suck, everything should be free) staves off any real competition.
    - noduerme 1mo ago
      I don't see how we could have more vulnerability, on a massive scale, than to have two companies which pre-install both the OS and the browser, on their own hardware in the case of Apple, for 95% of the planet. Microsoft was sued by the USDOJ in 1998 precisely for this, that it was leveraging the pre-installation of Windows to force Internet Explorer to be the default browser for PC consumers. That that was bad for both security and for the web seems pretty obvious in retrospect, when you think about the trajectory of IE. Apple's insistent blocking of non-webkit web engines, including V8, on its own hardware/iOS is an even more egregious and dangerous phenomenon. Browser security and browsers themselves would be vastly improved if they weren't a monopoly of the two mobile OS makers.
  - brookst 2mo ago
    Do the smaller browser makers pay more for big bounties?
    - Henchman21 2mo ago
      What smaller browser makers???

kccqzy 2mo ago

That’s exactly right, and applies to more than Google. I can’t think of a single browser vendor that would think a single vulnerability materially causes reputational damage.

thayne 2mo ago

But google is also a monopsony. There isn't anyone else the researcher can ethically sell it to. They just have to take whatever bounty google decides to pay.

noduerme 2mo ago
I'm just saying it's more evidence that Google should be broken up.
- xnx 2mo ago
  How would you break up Google that would make browsers more secure?
  - ruszki 2mo ago
    Google should have been split up into shreds like 2 decades ago. Search wants to have income from ads? Good sell it to anybody who pays the most, just like every single newspaper does. Gmail wants to sell our data, or ad space? Good sell them, and not just reuse them internally. Chrome wants to monetize every single request you do? Go, sell them on the open market. And not this fake, "we're separate companies, but only on paper" way. This should have been done a long time ago. Firefox, and the browser market would be much more healthy. Btw, Microsoft, Apple, Facebook, now even Twitter/SpaceX and all of these should have been forced the same way. And of course not just in this field, but all of them, like oil companies. They can pivot, of course, with some grace period, but that would mean giving up something at the end. And if we are there, we can abolish most of trade secrecy too, which exists only to keep up the status quo while hindering progress.
    - WarmWash 2mo ago
      Google is the answer to an Internet that largely blocks ads and uses backdoors to circumvent pay walls. A single massive pillar with enough surface area to carry all the dead weight. If people want a better internet, they can start fostering one, rather than endlessly complain that someone else should be fostering it for them. There will probably be upwards of 1000 people who read this comment that have used Google services for 15+ years, never loaded a single ad, and complain about Google ruining the internet. Please, pick-up a mirror. Nobody wants to build a competitor to serve your cheap ass
      - deleted 2mo ago
        [deleted]
      - sire-vc 1mo ago
        I dont like ads. Would you be willing to pay for content? Obviously not, stupid. This comment in general, not aimed at you.
      - genxy 1mo ago
        I pay for email and search. There are hundreds of us, hundreds.
      - aka-rider 1mo ago
        Google is routinely buying and destroying competitors. They lower prices to kill competition en-masse. They promote their own products in search and elsewhere over paid ads. Search Engine have chicken and egg problem, you can only have a good search if enough people use it to tune the ranking and see enough search spam cases. “Just compete with a monopoly on their own field with one hand tied behind”
        WarmWash 1mo ago
        Every Google competitor has the problem that 40% of users won't load ads and 99% won't pay a subscription. They don't need to do anything adversarial, the greed driven mindset of the internet (ads suck, everything should be free) staves off any real competition.
  - noduerme 1mo ago
    I don't see how we could have more vulnerability, on a massive scale, than to have two companies which pre-install both the OS and the browser, on their own hardware in the case of Apple, for 95% of the planet. Microsoft was sued by the USDOJ in 1998 precisely for this, that it was leveraging the pre-installation of Windows to force Internet Explorer to be the default browser for PC consumers. That that was bad for both security and for the web seems pretty obvious in retrospect, when you think about the trajectory of IE. Apple's insistent blocking of non-webkit web engines, including V8, on its own hardware/iOS is an even more egregious and dangerous phenomenon. Browser security and browsers themselves would be vastly improved if they weren't a monopoly of the two mobile OS makers.
- brookst 2mo ago
  Do the smaller browser makers pay more for big bounties?
  - Henchman21 2mo ago
    What smaller browser makers???