4 ms·

> Google security team acted really fast. This issue was fixed in 10 days. Wow I couldn't imagine how long a 'slower' response cloud be.

deleted 13y ago
[deleted]
tropicalmug 13y ago
11 days? Two weeks? A month? Never? Not every company values this sort of feedback from their users. Some go out of their way to prosecute those that break their services this way.
- expertmind 13y ago
  That is sad. There should be a some kind of TOS for public internet companies. While this kind of exploits does not hurt google but they can be very dangerous for users.
  - markeganfuller 13y ago
    Sounds like it would be a good extension to Data Protection / Computer Abuse/Misuse Acts depending on what it allows access to. Anyone pointing out a failing in your system should not be prosecuted unless they've actually committed a crime.
    - mdpopescu 13y ago
      That doesn't actually help; you need to think more like a prosecutor. By investigating the vulnerability they have, in fact, committed a crime - see for example http://blog.erratasec.com/2013/09/how-weevs-prosecutors-are-making-up.html http://blog.erratasec.com/2013/09/how-weevs-prosecutors-are-...
specialp 13y ago
That is very fast for something at a huge scale like Gmail. They had someone responsibly disclose the exploit so they fixed it quickly but not so quick as to destabilize Gmail by not properly testing/deploying. Making changes to software used by millions is not that easy.
patio11 13y ago
I have a remote DOS and possible code execution on one of the world's most widely deployed desktop applications. Their security team has been on top of it (got back an initial human response and responsible team member within 48 hours, etc), but the nature of the beast means that all subsequent steps take weeks to months. I can't remember off the top of my head, but I think we're at 4 months and counting.
- annnnd 13y ago
  Based on the description I think we can safely assume the company name starts with a letter 'M'. ;)
  - patio11 13y ago
    Professional courtesy suggests I should not confirm nor deny that. Let's just say that AmaGooBookSoft all have surface areas larger than the Death Star, and it is highly, highly unlikely that any of them have found all the exhaust ports yet.
    - oneeyedpigeon 13y ago
      Hey, I work at AmaGooBookSoft and I resent you calling out our poor security practices!
    - tedunangst 13y ago
      Whew! Apple is safe. :)
darren_ 13y ago
The last exploit I found in windows took about 6 months to get patched (this was in 2010, they may have improved). It was a 'ping of death' style instant bluescreen from one packet kind of exploit. 10 days is _nothing_.

deleted 13y ago

[deleted]

tropicalmug 13y ago

11 days? Two weeks? A month? Never? Not every company values this sort of feedback from their users. Some go out of their way to prosecute those that break their services this way.

expertmind 13y ago
That is sad. There should be a some kind of TOS for public internet companies. While this kind of exploits does not hurt google but they can be very dangerous for users.
- markeganfuller 13y ago
  Sounds like it would be a good extension to Data Protection / Computer Abuse/Misuse Acts depending on what it allows access to. Anyone pointing out a failing in your system should not be prosecuted unless they've actually committed a crime.
  - mdpopescu 13y ago
    That doesn't actually help; you need to think more like a prosecutor. By investigating the vulnerability they have, in fact, committed a crime - see for example http://blog.erratasec.com/2013/09/how-weevs-prosecutors-are-making-up.html http://blog.erratasec.com/2013/09/how-weevs-prosecutors-are-...

specialp 13y ago

That is very fast for something at a huge scale like Gmail. They had someone responsibly disclose the exploit so they fixed it quickly but not so quick as to destabilize Gmail by not properly testing/deploying. Making changes to software used by millions is not that easy.

patio11 13y ago

I have a remote DOS and possible code execution on one of the world's most widely deployed desktop applications. Their security team has been on top of it (got back an initial human response and responsible team member within 48 hours, etc), but the nature of the beast means that all subsequent steps take weeks to months. I can't remember off the top of my head, but I think we're at 4 months and counting.

annnnd 13y ago
Based on the description I think we can safely assume the company name starts with a letter 'M'. ;)
- patio11 13y ago
  Professional courtesy suggests I should not confirm nor deny that. Let's just say that AmaGooBookSoft all have surface areas larger than the Death Star, and it is highly, highly unlikely that any of them have found all the exhaust ports yet.
  - oneeyedpigeon 13y ago
    Hey, I work at AmaGooBookSoft and I resent you calling out our poor security practices!
  - tedunangst 13y ago
    Whew! Apple is safe. :)

darren_ 13y ago

The last exploit I found in windows took about 6 months to get patched (this was in 2010, they may have improved). It was a 'ping of death' style instant bluescreen from one packet kind of exploit. 10 days is _nothing_.