13 ms·

Microsoft hits out at Google team over bug report

97 points by oinkgrr 12y ago

Beltiras 12y ago
2 days leeway is not uncalled for. Bad form Google.
- nodata 12y ago
  Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).
  - shoggs 12y ago
    Apparently Microsoft needed some time for testing.
  - pilif 12y ago
    If Google insists on exactly 90 days without any consideration for patch Tuesdays, this means that, if unlucky, MS will only get 60 days (if they got the announcement right after a patch Tuesday)
    - gizmo686 12y ago
      The reason for giving 90 days is not that some issues are so complicated that they require 90 days to fix, but that bureaucracies can be slow and need a lot of extra time. In your case, that is 30 days of bureaucratic overhead, leaving them 60 days of actual work. This seems reasonable, as bussiness deadlines are 30 days.
    - tomiko_nakamura 12y ago
      So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.
      - Someone1234 12y ago
        > So, who forces Microsoft to stick to (so called) patch Tuesdays? Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates? > it's Microsoft internal schedule It's their external schedule actually.
        deleted 12y ago
        [deleted]
        jdjb 12y ago
        Why do all these customers need to be on Microsoft's schedule though? Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed. If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient.
        Someone1234 12y ago
        > Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed. They already do via WSUS. Companies get to plan this work to start on the second Tuesday of every month because that's the day Microsoft publishes them. Nobody puts a gun to company's heads and forces them to deploy internally. > If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient. This seems to be a complaint about a "policy" which doesn't exist and has no relationship to the topic at hand. I don't even really entirely understand the above.
        tomiko_nakamura 12y ago
        I don't really see how that matters. This only shows how utterly broken the concept of "patch Tuesdays" is ... If you plan your internal deployment updates based on the belief that the schedule will never change, then I'm really sorry for you and your users. In real world, not all issues are reported in advance - some are observed in the wild, and in that case you have to fast-track the fix. If you have no way to do that (e.g. because the vendor only releases fixes on Tuesdays once per month, or because you decided to choose such schedule on your own), then good luck. That might have been appropriate in 1995, not in 2015. There are many projects and/or companies publishing fixes continuously, and leaving it up to the users when/how to apply them in production. That's essentially what all the linux distributions (RH, Suse, ...) and smaller projects do.
  - majc2 12y ago
    And they asked for 92 days and Google decided to publish anyway? While I'm not surprised, it doesn't strike me as the most responsible action.
    - tomiko_nakamura 12y ago
      If you define a limit for disclosure, and then not stick to it, why to define a limit in the first place? 90 days is more than enough - if MS has a lot of internal overhead, you should probably complain to them, not to google.
      - majc2 12y ago
        "Our objective is to significantly reduce the number of people harmed by targeted attacks." (http://googleprojectzero.blogspot.co.uk/2014/07/announcing-project-zero.html http://googleprojectzero.blogspot.co.uk/2014/07/announcing-p...) They've lost sight of this noble objective with an inflexible policy; who anointed Project Zero guardians of the internet? Why not wait the two days? cui bono?
      - Beltiras 12y ago
        If contacted by the other party and they give a good reason (in this case: "We have a fix, it's slated for release in line with other things on tuesday"), I think a responsible security researcher should give that time. If patch day rolls around and no production, go ahead and shame. This is not a case of overhead, MS world functions a bit differently from package management in Linux.
  - _wmd 12y ago
    As another comment points out, unlike Google updates, Microsoft's occur on a particular day of every month. This allows end user IT departments to coordinate the updates as part of a predictable change management policy. In this case, the bug was reported on 13 Oct, 15 working days before the first Tuesday of November. Assuming Microsoft couldn't fix and test a change to a core service running on millions of desktops in that time, their only remaining opportunity within the disclosure window was the patch day in December - allowing them only 50 calendar days to deal with the bug. What's worse is that the bug isn't even all that severe. Effectively Google were trying to strong-arm Microsoft into releasing an out of band patch for a minor issue, which would have knock-on effects for thousands of IT departments. A completely dick move, and thankfully one that's being given recognition here. Shit like this is why I have a hard time dealing with the infosec community in general – a strange mix of conformance to pointless minutia, a deeply ingrained sense of self-importance (only worsening over time with PR crap like APT), and a fatal attraction with some of the most puerile elements of society. The result is a unique melting pot of genius and dumb that I regularly can't stomach.
- deleted 12y ago
  [deleted]
- spydum 12y ago
  unlikely we will know the true internal discussion, but it seems unlikely it realistically took MSFT 92 days to put together a patch. It seems far more likely they sat on the disclosure and did not prioritize it appropriately, after google continued to push for an estimated release date (which they never got). Then when the clock was running out, MSFT asked for extension, and Google being tired of getting put off, said no and stuck to their 90-day policy. all of the above is speculation, and I don't necessarily agree it was the right thing to do. However, I could see folks @ googles sec group being a bit pissed MSFT wasnt taking it seriously, and then decided to stand on their policy just to make an example (surely, MSFT wont drag feet on future disclosures after this, right?).
  - cmdkeen 12y ago
    Alternatively, and without your unsubstantiated knocking of Microsoft, perhaps they were needing to conduct serious regression testing. This isn't the "unit tests pass, whack it into production" leagues after all. Plus there's also the small matter of Christmas, and for many countries, significant developer unavailability falling into that period. What's more likely, Microsoft can produce, test and deploy a patch in a few days, but chose not to until they had to. Or that they did get a patch ready and tested, but not in time for the patch Tuesday the previous month (so actually got it done in ~62 days) but it didn't warrant an out of band release?
    - orf 12y ago
      The run tests over every single supported version of Windows, on every platform and with every combination of patches installed. Or so I read in an article by a MS employee who deals with security reports, someone sent in a nonsense 'vulnerability' with some C# POC involving MessageBox.Show and returning from main. It was obviously not in any way a issue, but he still ran it across all versions and patch-levels of windows to be sure. It doesn't say how long this took but I expect it wasn't fast.
    - doodpants 12y ago
      Arguably, the fact that Google was going to reveal the vulnerability two days before the next patch Tuesday could have been considered sufficient reason to warrant an out of band realease.
pilif 12y ago
This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third). MS is a huge company with an immense installed base and they have to be understandably careful with pushing updates. Working with them to disclose vulnerability on their regular patch day really wouldn't be such a bad thing for either Google nor the end users, even more so as we're talking about two days here and there even was a holiday week in the timespan. This is about being an ass and I see no advantages for end users. Even if Microsoft had not responded to Google at all, they could have waited for full three patch days (again, MS' patch deployment timeline is very much public knowledge by now) before publicly disclosing the issue.
- timonovici 12y ago
  What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?
  - smackfu 12y ago
    Does it really matter if it's 90 or 92 day disclosure?
    - cskau 12y ago
      Or you could ask: do two more days of the bug being secretly exploited in the wild matter?
      - Gigablah 12y ago
        As opposed to 2 days of the bug being openly exploited?
    - JumpCrisscross 12y ago
presootto 12y ago
Google is just a bunch of hypocrites. Do you remember what happened when they're new ReCaptcha was reverse engineered? Let me remind you: https://news.ycombinator.com/item?id=8728336 https://news.ycombinator.com/item?id=8728336 Disclaimer: I work for TAGA (The Arrogant Google Assholes)
- nodata 12y ago
  Do you know if Microsoft actually talked to Google about waiting a couple more days, or are MS just saying that in their press release?
  - ddeck 12y ago
    From the article: >"We asked Google to work with us to protect customers by withholding details until Tuesday, January 13, when we will be releasing a fix," Microsoft's senior director of research Chris Betz said in a blog post.
    - tomiko_nakamura 12y ago
      You're just citing the press release (or a blog post, or whatever). How does that respond to the original question? The issue mentioned in the article [https://code.google.com/p/google-security-research/issues/detail?id=123 https://code.google.com/p/google-security-research/issues/de...] says that: > Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. < Microsoft were informed that the 90 day deadline is fixed for all vendors and bug classes and so cannot be extended. Further they were informed that the 90 day deadline for this issue expires on the 11th Jan 2015. So (a) Microsoft is unable to comprehend a simple 90-day policy or (b) do basic math.
      - Gigablah 12y ago
        (c) is perfectly capable of both, and since we're mature and reasonable adults here, we'll leave open the possibility of extenuating factors
WestCoastJustin 12y ago
TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples priorities. There is a published 90 day policy, they gave 90 days notice, figure it out. There is also details missing about the communication between Google and Microsoft. Like when they asked for an extension, etc.
- smackfu 12y ago
  Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.
  - deleted 12y ago
    [deleted]
  - michaelt 12y ago
    The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness. You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...
- gtirloni 12y ago
  If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.
  - tomiko_nakamura 12y ago
    If you start making exceptions, everyone will want one.
valevk 12y ago
This is the issue: https://code.google.com/p/google-security-research/issues/detail?id=123 https://code.google.com/p/google-security-research/issues/de...
forgottenpass 12y ago
"Microsoft's senior director of research Chris Betz said in a blog post.", "Several security researchers", "wrote one developer", "But another said" So is this what the disclosure issue is going to look like when packaged up for the masses? No historical context on how the ongoing disagreements are the latest in decades of ongoing discussion? Or any mention of the events that shaped the popular ideas today? Just a sour blogpost and some bland quotes of agreement and disagreement from an internet so large you can always find quotes for the positions you want to portray. We're so fucked. Edit: And apparently it worked on us too. Of course external messaging is going to paint the other guy as the unreasonable one.
- herge 12y ago
  Welcome to the wide and unimpressive world of tech journalism. On the other hand, you get what you pay for.
- cheald 12y ago
  I entirely expect the journalist writing this article has no knowledge of the intricacies of disclosure politics.
mark_l_watson 12y ago
What? Microsoft asked for 2 extra days and Google refused? Seems like an asshole move. I am in general a huge Google fan, but in using Google services I realize that I am not much of a customer (I purchase extra storage and buy stuff on the Play Store); advertisers are the customers. Microsoft on the other hand gets its money from computer users and it seems like they have a much more customer focused mentality.
- deleted 12y ago
  [deleted]
- jenscow 12y ago
  or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)
  - mark_l_watson 12y ago
    I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.
    - fixermark 12y ago
      Of course, the thing about 0-days is that it's hard to say if those users wouldn't have been hurt anyway as the underground community exploited the known-only-to-them, Google, and Microsoft bug.
    - kstrauser 12y ago
      That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.
      - WorldWideWayne 12y ago
        Sure it is. We know that less people knew the details before Google released the details. > Historically, it's more likely... But going on what is actually known, less people knew before Google's actions than after. EDIT: More accurately: We know that the information was definitely available after Google's action. We don't know that the information was definitely available before.
fgoogle 12y ago
Oh my God the google circlejerk has spilled from Reddit. How many people does google have sockpuppetting social media? My goodness.
k-mcgrady 12y ago
*repost of my comment from another post on this subject[1] >> "Google's Project Zero seeks to find bugs in popular software and then give the manufacturers responsible 90 days to fix the problem." Seems reasonable. >> "On 11 January, Google publicised the flaw. Microsoft said it had requested that Google wait until it released a patch on 13 January." Dick move. Sorry, I can't think of any other way to describe it. They may have waited until the last minute (or maybe they really did have to rewrite a tonne of code) but that's no excuse or putting users at risk when you can wait two days. Seems more like a marketing tactic than a desire for faster security patches. [1]https://news.ycombinator.com/item?id=8873704 https://news.ycombinator.com/item?id=8873704
xxyyzz3d 12y ago
I think there is something to notice about having a hard fixed timeline for everyone. See from the bug: https://code.google.com/p/google-security-research/issues/detail?id=123 https://code.google.com/p/google-security-research/issues/de... > Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. < Microsoft were informed that the 90 day deadline is fixed for all vendors and bug classes and so cannot be extended. Further they were informed that the 90 day deadline for this issue expires on the 11th Jan 2015. > Microsoft confirmed that they anticipate to provide fixes for these issues in January 2015. So basically Microsoft asked for an extra month, and they said no, which forced them to move quicker, and fix it a month earlier. Without picking any side of the debate, you can still see what effect the non-negotiation of timeline has on getting patches out as soon as possible.
- freehunter 12y ago
  Which sounds like blackmail to me. What did Microsoft have to put aside to move this up in their schedule? Maybe now the release date for Microsoft's new browser slips, giving Google the upper hand? Should corporations force their competitors to move like this? "If you don't drop everything, we're going to release vulnerability details about your product"? I work in information security and patches are important, I understand. But it worries me that what we're basically seeing here is corporate warfare using security vulnerabilities. What gives any company the right to publish vulnerabilities about their competitors, especially when it has the chance to impact their competitor's performance? Does Pepsi have the right to demand Coke rotate the tires on their trucks within 90 days or they will publish the recipe for Coca Cola?
  - teraflop 12y ago
    What a disingenuous comparison. It's not "accede to our demands or we'll publish this information"; it's "we're publishing this information in 90 days whether you like it or not." If we ask "what gives any company the right to publish vulnerabilities about their competitors?" it's only a short step to asking "what gives journalists the right to publish scathing negative reviews?" The answer is the same: freedom of speech. It's a fact of life that if you want to fix security bugs, that takes time away from working on other things. If you don't like it, fix the bugs faster, or pay more attention to security from the get-go. Microsoft should be thanking Google for finding the bug in the first place.
LukeB_UK 12y ago
Everyone is saying that Google should have waited for Microsoft's patch day, but why should Google bend their standard procedure to fit Microsoft? If it really meant that much to Microsoft, they could have released a patch earlier. They knew they had 90 days and decided to ignore it.
- RubyPinch 12y ago
  "but why should Google bend their standard procedure to fit Microsoft?" well, there are quite a few users affected.
  - delinka 12y ago
    All the more reason for Microsoft to get to it and release the patch sooner. MS had already said they intended to delay the fix until February. The 90-day deadline seems to be Working As Designed®
- outside1234 12y ago
  Because its the "do no evil" way. That used to matter. I guarantee you that if this was an Android bug that the Android team would have gotten 2 more days. That's the inconsistency here. God help Google if an Android bug is discovered that takes them more than 90 days to patch across their 123421 variants of fragmentation.
- WorldWideWayne 12y ago
  Because "They don't have all of the OS code so they have no idea how much other code would have to be rewritten to correct the problem." and "That extra coding takes time to ensure that something else doesn't get broken in the process."
droopybuns 12y ago
A few observations: Google headcount: ~49k MS headcount: ~130k There is going to be a huge difference in speed based on size alone, but MS also has a much greater commitment to regression testing than Google ever has. Google has embraced an engineering culture where the security team can contribute fixes directly to their own projects. I imagine this creates an unreasonable prejudice culture about how easy it is to implement fixes without concern for regression issues. You can see examples of this in recent e.o.y will not fix bug closures in AOSP. Those savants are going to set the usability vs security debate back a decade by by marking all http connections as insecure. Finally, don't forget that Eric Schmidt agreed to a recruiting cease fire. For. All of their pride and arrogance, those Google security engineers are never going to escape the fact that they have compromised their own potential maximum value so they can sneer at other companies cultures. Toxic and stupid.
franzwong 12y ago
How about Google sponsors Microsoft human and financial support to fix the bugs if they really care about that?
jnbiche 12y ago
Look, I'm been really happy with a lot of the stuff Microsoft has been doing recently, particularly in open source. But this is ridiculous. They had plenty of notice that Microsoft's standard 90-day (90 day!) policy applied, and that no exceptions were going to be made. I applaud Google for not bending on their 90-day deadline (assuming they do hold all companies to that, and it appears they do). Maybe this incident will help encourage some companies that might otherwise be lax when confronted with a bug to hurry up. There's no telling who else knew about this bug and was actively exploiting it (probably lots of people).
- Someone1234 12y ago
  > There's no telling who else knew about this bug and was actively exploiting it (probably lots of people). You have no reason to believe it was a "lot of people." In fact we have no reports of people exploiting it in the wild at all, unless you have some information we don't. edit: Downmod me all you wish, but substantiate your claims. Where is this being exploited in the wild before Google released it?
  - jnbiche 12y ago
    My exact phrase was "there's no telling", which is meant to indicate uncertainty. We don't know who or how this was exploited (if at all). But I agree with you that I shouldn't have written "probably lots of people". I have no basis for that assertion. I retract that sentence (but not the rest). By the way, I didn't downvote you. In fact, I almost certainly would have even upvoted your comment if you hadn't made the edit complaining about the downvote (against HN guidelines) and accusing me of downvoting you (false accusation). As a general rule, you should never assume that the person you're disagreeing with was the one who downvoted. Many of us on HN only downvote people who are making low-information comments (which your comment was not, indeed it made me reconsider an assertion) or comments made in bad faith (yours was not, as far as I know).
- dwild 12y ago
  Personally I feel like they should allow stuff like 2 days more, but they would need to be really strict about it. Reading the comments on the ticket however, I really feel like Microsoft was in the wrong here. They asked 4 days ago to push it for a whole month and then now they are fine for their January release. I really feel like they start to feel the pressure of the 90 days so being strict about it is a good choice from Google.
tptacek 12y ago
Graham Cluley isn't a vulnerability researcher; he's a blogger and former antivirus author. Old school antivirus people are like the opposite of vulnerability researchers.
jorgecastillo 12y ago
It seems reasonable for Google to release the details of the bug. If they make an exception for one company they'd have to start making exceptions for all companies. Microsoft is at fault here for not fixing this on time.
bagacrap 12y ago
The linked bug shows that it was discovered Sep 30 and revealed publicly on Dec 30. Thus MS missed the deadline by two weeks, not two days. I agree there should be some flexibility but where do you draw the line?
deleted 12y ago
[deleted]
shogun21 12y ago
Isn't this all MS's fault for having a security flaw in their system? If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window. Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.
- iolothebard 12y ago
  Yeah, MS should develop flawless software like everyone else.
doe88 12y ago
If I were MS I wouldn't complain on this issue and instead I would just take the bait and put an internal team to find out bugs exclusively in Google products like for instance Android [1] and declare an arbitrary short disclosure policy [2] and then release these bugs when time is up. [1] https://news.ycombinator.com/item?id=8874339 https://news.ycombinator.com/item?id=8874339 [2] https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pleased-website-exploits-microsoft-zeroday/ https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pl...
- danielweber 12y ago
  Two wrongs don't make a right. This is an arms race that will not benefit users.
chappi42 12y ago
> Then again what does Google care, they don't use or support anything Microsoft, so it doesn't affect them What does Google care? I get the impression they care about not much else than ads and HUGE NUMBERS of users.
outside1234 12y ago
"Do no evil" Unless it hurts a competitor and is bad for their customers.
- cheald 12y ago
  Google's action resulted in a security bugfix which improved the security of Windows, and on faster schedule than Microsoft would have provided otherwise. But sure, let's call it evil.
  - outside1234 12y ago
    I get that. I don't get that they didn't let Microsoft fit it into their patch schedule (2 days later). I don't believe for a second that they would have disclosed this if it was Android and they had a fix that would land within 2 days. No f'ing way. That's the evil.
    - cheald 12y ago
      Microsoft's patch schedule was going to be 32 days later. The hard stance produced a positive outcome here; the patch was available a full month earlier than it otherwise would have been. There is a lot of history between security researchers and big vendors, where the big vendor just delays and delays and delays while the bug is running around out in the wild. I really do hear what you're saying, and while I'm sympathetic to it, I think that it's much more likely that the Project Zero team adopted the 90-day policy specifically because of years and years of vendors playing push-the-deadline. If there was an industry history of vendors acting promptly in good faith, this wouldn't even be a thing, but the politics behind bug reporting and disclosure are really pretty mature at this point, and I really do think it's naive to just chalk it up to "Google wants to embarrass its competition and is playing dirty to do it".
andyrj 12y ago
Google expended their resources to find a flaw in a MS product, in which MS was treated as any other vendor. If MS requires the ability to dictate the time alloted to fix their own mistakes, and are unwilling to change their own internal priorities for the sake of their own user base. Then perhaps, they should have found and fixed this prior to Google needing to point it out for them? I am amazed at the blind hatred for Google on this when MS has had a less than spectacular performance with its patches in the last year. Did all the MS fanbois forget about the bsod's just a few months back from MS's own "flawless", as you all seem to believe, patch schedule? (MS14-045 and MS13-036) If this deadline, self imposed by MS, is so greatly beneficial to MS patching why didn't the magic of patch Tuesday prevent those incidents?
jrockway 12y ago
I'm looking forward to the "Scroogled" ads and merchandise highlighting this issue.
fixermark 12y ago
Turning the question on its ear a bit: Even given that Windows 8.1 is a large and complicated machine, what was it about this particular bug that required basically all of Q4 for MS to patch it? It's one bug. I have a sinking suspicion that MS simply didn't consider it a priority, even after responsible disclosure to them, which is why it's good that Google's public disclosure policy is a hard-limit 90 days. Too many companies, when given the option to choose their own priority tree over the priority tree enforced by security needs, will choose the former.
sgdread 12y ago
You think that 2 days is nothing, but look at this from other perspective: first time MS asks for 2 days (BTW, as others pointed, initially MS said it's not going to be fixed until Feb), next time they ask for a week: last time you gave us 92 days, couldn't you wait for another 3 days? And then it goes, and goes. Then other company asks for a week. If google refuses, there will be unfair treatment and might cause bad press (much worse than this one). So as despite it looked like a dick move, I fully support google's actions. If you compromise on policy once, you're done. So 90 days is a 90 days, no matter what. I think it was a lesson to MS: take this policy with respect and avoid this in future. I'm a software developer and I know how difficult to fix big systems like Windows (burocracy must be crazy there), but the only way to challenge broken processes is to put pressure, otherwise it will never change.
wnevets 12y ago
Hasnt Microsoft released "out of band" patches before? Why is this one so special?
- danielweber 12y ago
  Out of band happens when there is a security issue actively being exploited in the wild.
dogpa 12y ago
Microsoft has been shipping steaming crapola for decades. Their unwieldy and unmaintainable codebase is their own fault. This should not be news to anyone who is unfortunate enough to have to use their awful products. They sought to dominate the market by means other than having the best talent and shipping the best software. It worked but now they have a problem. And who can forget this? http://blog.zorinaq.com/?e=74 http://blog.zorinaq.com/?e=74 Developers developers developers. Any vulns I find will not be dealt with in such a charitable manner. (i.e. you have exactly zero days to fix your shit). Why on Earth are Google wasting their own resources doing Microsoft's work for them? Tiny, tiny violins, Microsoft. Tiny, tiny violins.
realcul 12y ago
Google please fix your issues [1] before you leak zero day issues about your competitor... [1] http://www.zdnet.com/article/google-stops-providing-patches-for-pre-kitkat-webview-abandons-930m-users/ http://www.zdnet.com/article/google-stops-providing-patches-...
divs1210 12y ago
Microsoft will be celebrating a lot of Merge Days[1]. [1]: http://thedailywtf.com/articles/Happy_Merge_Day http://thedailywtf.com/articles/Happy_Merge_Day!

97 points by oinkgrr 12y ago

Beltiras 12y ago

2 days leeway is not uncalled for. Bad form Google.

nodata 12y ago
Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).
- shoggs 12y ago
  Apparently Microsoft needed some time for testing.
- pilif 12y ago
  If Google insists on exactly 90 days without any consideration for patch Tuesdays, this means that, if unlucky, MS will only get 60 days (if they got the announcement right after a patch Tuesday)
  - gizmo686 12y ago
    The reason for giving 90 days is not that some issues are so complicated that they require 90 days to fix, but that bureaucracies can be slow and need a lot of extra time. In your case, that is 30 days of bureaucratic overhead, leaving them 60 days of actual work. This seems reasonable, as bussiness deadlines are 30 days.
  - tomiko_nakamura 12y ago
    So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.
    - Someone1234 12y ago
      > So, who forces Microsoft to stick to (so called) patch Tuesdays? Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates? > it's Microsoft internal schedule It's their external schedule actually.
      - deleted 12y ago
        [deleted]
      - jdjb 12y ago
        Why do all these customers need to be on Microsoft's schedule though? Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed. If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient.
        Someone1234 12y ago
        > Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed. They already do via WSUS. Companies get to plan this work to start on the second Tuesday of every month because that's the day Microsoft publishes them. Nobody puts a gun to company's heads and forces them to deploy internally. > If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient. This seems to be a complaint about a "policy" which doesn't exist and has no relationship to the topic at hand. I don't even really entirely understand the above.
      - tomiko_nakamura 12y ago
        I don't really see how that matters. This only shows how utterly broken the concept of "patch Tuesdays" is ... If you plan your internal deployment updates based on the belief that the schedule will never change, then I'm really sorry for you and your users. In real world, not all issues are reported in advance - some are observed in the wild, and in that case you have to fast-track the fix. If you have no way to do that (e.g. because the vendor only releases fixes on Tuesdays once per month, or because you decided to choose such schedule on your own), then good luck. That might have been appropriate in 1995, not in 2015. There are many projects and/or companies publishing fixes continuously, and leaving it up to the users when/how to apply them in production. That's essentially what all the linux distributions (RH, Suse, ...) and smaller projects do.
- majc2 12y ago
  And they asked for 92 days and Google decided to publish anyway? While I'm not surprised, it doesn't strike me as the most responsible action.
  - tomiko_nakamura 12y ago
    If you define a limit for disclosure, and then not stick to it, why to define a limit in the first place? 90 days is more than enough - if MS has a lot of internal overhead, you should probably complain to them, not to google.
    - majc2 12y ago
      "Our objective is to significantly reduce the number of people harmed by targeted attacks." (http://googleprojectzero.blogspot.co.uk/2014/07/announcing-project-zero.html http://googleprojectzero.blogspot.co.uk/2014/07/announcing-p...) They've lost sight of this noble objective with an inflexible policy; who anointed Project Zero guardians of the internet? Why not wait the two days? cui bono?
    - Beltiras 12y ago
      If contacted by the other party and they give a good reason (in this case: "We have a fix, it's slated for release in line with other things on tuesday"), I think a responsible security researcher should give that time. If patch day rolls around and no production, go ahead and shame. This is not a case of overhead, MS world functions a bit differently from package management in Linux.
- _wmd 12y ago
  As another comment points out, unlike Google updates, Microsoft's occur on a particular day of every month. This allows end user IT departments to coordinate the updates as part of a predictable change management policy. In this case, the bug was reported on 13 Oct, 15 working days before the first Tuesday of November. Assuming Microsoft couldn't fix and test a change to a core service running on millions of desktops in that time, their only remaining opportunity within the disclosure window was the patch day in December - allowing them only 50 calendar days to deal with the bug. What's worse is that the bug isn't even all that severe. Effectively Google were trying to strong-arm Microsoft into releasing an out of band patch for a minor issue, which would have knock-on effects for thousands of IT departments. A completely dick move, and thankfully one that's being given recognition here. Shit like this is why I have a hard time dealing with the infosec community in general – a strange mix of conformance to pointless minutia, a deeply ingrained sense of self-importance (only worsening over time with PR crap like APT), and a fatal attraction with some of the most puerile elements of society. The result is a unique melting pot of genius and dumb that I regularly can't stomach.
deleted 12y ago
[deleted]
spydum 12y ago
unlikely we will know the true internal discussion, but it seems unlikely it realistically took MSFT 92 days to put together a patch. It seems far more likely they sat on the disclosure and did not prioritize it appropriately, after google continued to push for an estimated release date (which they never got). Then when the clock was running out, MSFT asked for extension, and Google being tired of getting put off, said no and stuck to their 90-day policy. all of the above is speculation, and I don't necessarily agree it was the right thing to do. However, I could see folks @ googles sec group being a bit pissed MSFT wasnt taking it seriously, and then decided to stand on their policy just to make an example (surely, MSFT wont drag feet on future disclosures after this, right?).
- cmdkeen 12y ago
  Alternatively, and without your unsubstantiated knocking of Microsoft, perhaps they were needing to conduct serious regression testing. This isn't the "unit tests pass, whack it into production" leagues after all. Plus there's also the small matter of Christmas, and for many countries, significant developer unavailability falling into that period. What's more likely, Microsoft can produce, test and deploy a patch in a few days, but chose not to until they had to. Or that they did get a patch ready and tested, but not in time for the patch Tuesday the previous month (so actually got it done in ~62 days) but it didn't warrant an out of band release?
  - orf 12y ago
    The run tests over every single supported version of Windows, on every platform and with every combination of patches installed. Or so I read in an article by a MS employee who deals with security reports, someone sent in a nonsense 'vulnerability' with some C# POC involving MessageBox.Show and returning from main. It was obviously not in any way a issue, but he still ran it across all versions and patch-levels of windows to be sure. It doesn't say how long this took but I expect it wasn't fast.
  - doodpants 12y ago
    Arguably, the fact that Google was going to reveal the vulnerability two days before the next patch Tuesday could have been considered sufficient reason to warrant an out of band realease.

pilif 12y ago

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third). MS is a huge company with an immense installed base and they have to be understandably careful with pushing updates. Working with them to disclose vulnerability on their regular patch day really wouldn't be such a bad thing for either Google nor the end users, even more so as we're talking about two days here and there even was a holiday week in the timespan. This is about being an ass and I see no advantages for end users. Even if Microsoft had not responded to Google at all, they could have waited for full three patch days (again, MS' patch deployment timeline is very much public knowledge by now) before publicly disclosing the issue.

timonovici 12y ago
What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?
- smackfu 12y ago
  Does it really matter if it's 90 or 92 day disclosure?
  - cskau 12y ago
    Or you could ask: do two more days of the bug being secretly exploited in the wild matter?
    - Gigablah 12y ago
      As opposed to 2 days of the bug being openly exploited?
  - JumpCrisscross 12y ago

presootto 12y ago

Google is just a bunch of hypocrites. Do you remember what happened when they're new ReCaptcha was reverse engineered? Let me remind you: https://news.ycombinator.com/item?id=8728336 https://news.ycombinator.com/item?id=8728336 Disclaimer: I work for TAGA (The Arrogant Google Assholes)

nodata 12y ago
Do you know if Microsoft actually talked to Google about waiting a couple more days, or are MS just saying that in their press release?
- ddeck 12y ago
  From the article: >"We asked Google to work with us to protect customers by withholding details until Tuesday, January 13, when we will be releasing a fix," Microsoft's senior director of research Chris Betz said in a blog post.
  - tomiko_nakamura 12y ago
    You're just citing the press release (or a blog post, or whatever). How does that respond to the original question? The issue mentioned in the article [https://code.google.com/p/google-security-research/issues/detail?id=123 https://code.google.com/p/google-security-research/issues/de...] says that: > Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. < Microsoft were informed that the 90 day deadline is fixed for all vendors and bug classes and so cannot be extended. Further they were informed that the 90 day deadline for this issue expires on the 11th Jan 2015. So (a) Microsoft is unable to comprehend a simple 90-day policy or (b) do basic math.
    - Gigablah 12y ago
      (c) is perfectly capable of both, and since we're mature and reasonable adults here, we'll leave open the possibility of extenuating factors

WestCoastJustin 12y ago

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples priorities. There is a published 90 day policy, they gave 90 days notice, figure it out. There is also details missing about the communication between Google and Microsoft. Like when they asked for an extension, etc.

smackfu 12y ago
Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.
- deleted 12y ago
  [deleted]
- michaelt 12y ago
  The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness. You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...
gtirloni 12y ago
If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.
- tomiko_nakamura 12y ago
  If you start making exceptions, everyone will want one.

valevk 12y ago

This is the issue: https://code.google.com/p/google-security-research/issues/detail?id=123 https://code.google.com/p/google-security-research/issues/de...

forgottenpass 12y ago

"Microsoft's senior director of research Chris Betz said in a blog post.", "Several security researchers", "wrote one developer", "But another said" So is this what the disclosure issue is going to look like when packaged up for the masses? No historical context on how the ongoing disagreements are the latest in decades of ongoing discussion? Or any mention of the events that shaped the popular ideas today? Just a sour blogpost and some bland quotes of agreement and disagreement from an internet so large you can always find quotes for the positions you want to portray. We're so fucked. Edit: And apparently it worked on us too. Of course external messaging is going to paint the other guy as the unreasonable one.

herge 12y ago
Welcome to the wide and unimpressive world of tech journalism. On the other hand, you get what you pay for.
cheald 12y ago
I entirely expect the journalist writing this article has no knowledge of the intricacies of disclosure politics.

mark_l_watson 12y ago

What? Microsoft asked for 2 extra days and Google refused? Seems like an asshole move. I am in general a huge Google fan, but in using Google services I realize that I am not much of a customer (I purchase extra storage and buy stuff on the Play Store); advertisers are the customers. Microsoft on the other hand gets its money from computer users and it seems like they have a much more customer focused mentality.

deleted 12y ago
[deleted]
jenscow 12y ago
or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)
- mark_l_watson 12y ago
  I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.
  - fixermark 12y ago
    Of course, the thing about 0-days is that it's hard to say if those users wouldn't have been hurt anyway as the underground community exploited the known-only-to-them, Google, and Microsoft bug.
  - kstrauser 12y ago
    That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.
    - WorldWideWayne 12y ago
      Sure it is. We know that less people knew the details before Google released the details. > Historically, it's more likely... But going on what is actually known, less people knew before Google's actions than after. EDIT: More accurately: We know that the information was definitely available after Google's action. We don't know that the information was definitely available before.

fgoogle 12y ago

Oh my God the google circlejerk has spilled from Reddit. How many people does google have sockpuppetting social media? My goodness.

k-mcgrady 12y ago

*repost of my comment from another post on this subject[1] >> "Google's Project Zero seeks to find bugs in popular software and then give the manufacturers responsible 90 days to fix the problem." Seems reasonable. >> "On 11 January, Google publicised the flaw. Microsoft said it had requested that Google wait until it released a patch on 13 January." Dick move. Sorry, I can't think of any other way to describe it. They may have waited until the last minute (or maybe they really did have to rewrite a tonne of code) but that's no excuse or putting users at risk when you can wait two days. Seems more like a marketing tactic than a desire for faster security patches. [1]https://news.ycombinator.com/item?id=8873704 https://news.ycombinator.com/item?id=8873704

xxyyzz3d 12y ago

I think there is something to notice about having a hard fixed timeline for everyone. See from the bug: https://code.google.com/p/google-security-research/issues/detail?id=123 https://code.google.com/p/google-security-research/issues/de... > Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. < Microsoft were informed that the 90 day deadline is fixed for all vendors and bug classes and so cannot be extended. Further they were informed that the 90 day deadline for this issue expires on the 11th Jan 2015. > Microsoft confirmed that they anticipate to provide fixes for these issues in January 2015. So basically Microsoft asked for an extra month, and they said no, which forced them to move quicker, and fix it a month earlier. Without picking any side of the debate, you can still see what effect the non-negotiation of timeline has on getting patches out as soon as possible.

freehunter 12y ago
Which sounds like blackmail to me. What did Microsoft have to put aside to move this up in their schedule? Maybe now the release date for Microsoft's new browser slips, giving Google the upper hand? Should corporations force their competitors to move like this? "If you don't drop everything, we're going to release vulnerability details about your product"? I work in information security and patches are important, I understand. But it worries me that what we're basically seeing here is corporate warfare using security vulnerabilities. What gives any company the right to publish vulnerabilities about their competitors, especially when it has the chance to impact their competitor's performance? Does Pepsi have the right to demand Coke rotate the tires on their trucks within 90 days or they will publish the recipe for Coca Cola?
- teraflop 12y ago
  What a disingenuous comparison. It's not "accede to our demands or we'll publish this information"; it's "we're publishing this information in 90 days whether you like it or not." If we ask "what gives any company the right to publish vulnerabilities about their competitors?" it's only a short step to asking "what gives journalists the right to publish scathing negative reviews?" The answer is the same: freedom of speech. It's a fact of life that if you want to fix security bugs, that takes time away from working on other things. If you don't like it, fix the bugs faster, or pay more attention to security from the get-go. Microsoft should be thanking Google for finding the bug in the first place.

LukeB_UK 12y ago

Everyone is saying that Google should have waited for Microsoft's patch day, but why should Google bend their standard procedure to fit Microsoft? If it really meant that much to Microsoft, they could have released a patch earlier. They knew they had 90 days and decided to ignore it.

RubyPinch 12y ago
"but why should Google bend their standard procedure to fit Microsoft?" well, there are quite a few users affected.
- delinka 12y ago
  All the more reason for Microsoft to get to it and release the patch sooner. MS had already said they intended to delay the fix until February. The 90-day deadline seems to be Working As Designed®
outside1234 12y ago
Because its the "do no evil" way. That used to matter. I guarantee you that if this was an Android bug that the Android team would have gotten 2 more days. That's the inconsistency here. God help Google if an Android bug is discovered that takes them more than 90 days to patch across their 123421 variants of fragmentation.
WorldWideWayne 12y ago
Because "They don't have all of the OS code so they have no idea how much other code would have to be rewritten to correct the problem." and "That extra coding takes time to ensure that something else doesn't get broken in the process."

droopybuns 12y ago

A few observations: Google headcount: ~49k MS headcount: ~130k There is going to be a huge difference in speed based on size alone, but MS also has a much greater commitment to regression testing than Google ever has. Google has embraced an engineering culture where the security team can contribute fixes directly to their own projects. I imagine this creates an unreasonable prejudice culture about how easy it is to implement fixes without concern for regression issues. You can see examples of this in recent e.o.y will not fix bug closures in AOSP. Those savants are going to set the usability vs security debate back a decade by by marking all http connections as insecure. Finally, don't forget that Eric Schmidt agreed to a recruiting cease fire. For. All of their pride and arrogance, those Google security engineers are never going to escape the fact that they have compromised their own potential maximum value so they can sneer at other companies cultures. Toxic and stupid.

franzwong 12y ago

How about Google sponsors Microsoft human and financial support to fix the bugs if they really care about that?

jnbiche 12y ago

Look, I'm been really happy with a lot of the stuff Microsoft has been doing recently, particularly in open source. But this is ridiculous. They had plenty of notice that Microsoft's standard 90-day (90 day!) policy applied, and that no exceptions were going to be made. I applaud Google for not bending on their 90-day deadline (assuming they do hold all companies to that, and it appears they do). Maybe this incident will help encourage some companies that might otherwise be lax when confronted with a bug to hurry up. There's no telling who else knew about this bug and was actively exploiting it (probably lots of people).

Someone1234 12y ago
> There's no telling who else knew about this bug and was actively exploiting it (probably lots of people). You have no reason to believe it was a "lot of people." In fact we have no reports of people exploiting it in the wild at all, unless you have some information we don't. edit: Downmod me all you wish, but substantiate your claims. Where is this being exploited in the wild before Google released it?
- jnbiche 12y ago
  My exact phrase was "there's no telling", which is meant to indicate uncertainty. We don't know who or how this was exploited (if at all). But I agree with you that I shouldn't have written "probably lots of people". I have no basis for that assertion. I retract that sentence (but not the rest). By the way, I didn't downvote you. In fact, I almost certainly would have even upvoted your comment if you hadn't made the edit complaining about the downvote (against HN guidelines) and accusing me of downvoting you (false accusation). As a general rule, you should never assume that the person you're disagreeing with was the one who downvoted. Many of us on HN only downvote people who are making low-information comments (which your comment was not, indeed it made me reconsider an assertion) or comments made in bad faith (yours was not, as far as I know).
dwild 12y ago
Personally I feel like they should allow stuff like 2 days more, but they would need to be really strict about it. Reading the comments on the ticket however, I really feel like Microsoft was in the wrong here. They asked 4 days ago to push it for a whole month and then now they are fine for their January release. I really feel like they start to feel the pressure of the 90 days so being strict about it is a good choice from Google.

tptacek 12y ago

Graham Cluley isn't a vulnerability researcher; he's a blogger and former antivirus author. Old school antivirus people are like the opposite of vulnerability researchers.

jorgecastillo 12y ago

It seems reasonable for Google to release the details of the bug. If they make an exception for one company they'd have to start making exceptions for all companies. Microsoft is at fault here for not fixing this on time.

bagacrap 12y ago

The linked bug shows that it was discovered Sep 30 and revealed publicly on Dec 30. Thus MS missed the deadline by two weeks, not two days. I agree there should be some flexibility but where do you draw the line?

deleted 12y ago

[deleted]

shogun21 12y ago

Isn't this all MS's fault for having a security flaw in their system? If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window. Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.

iolothebard 12y ago
Yeah, MS should develop flawless software like everyone else.

doe88 12y ago

If I were MS I wouldn't complain on this issue and instead I would just take the bait and put an internal team to find out bugs exclusively in Google products like for instance Android [1] and declare an arbitrary short disclosure policy [2] and then release these bugs when time is up. [1] https://news.ycombinator.com/item?id=8874339 https://news.ycombinator.com/item?id=8874339 [2] https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pleased-website-exploits-microsoft-zeroday/ https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pl...

danielweber 12y ago
Two wrongs don't make a right. This is an arms race that will not benefit users.

chappi42 12y ago

> Then again what does Google care, they don't use or support anything Microsoft, so it doesn't affect them What does Google care? I get the impression they care about not much else than ads and HUGE NUMBERS of users.

outside1234 12y ago

"Do no evil" Unless it hurts a competitor and is bad for their customers.

cheald 12y ago
Google's action resulted in a security bugfix which improved the security of Windows, and on faster schedule than Microsoft would have provided otherwise. But sure, let's call it evil.
- outside1234 12y ago
  I get that. I don't get that they didn't let Microsoft fit it into their patch schedule (2 days later). I don't believe for a second that they would have disclosed this if it was Android and they had a fix that would land within 2 days. No f'ing way. That's the evil.
  - cheald 12y ago
    Microsoft's patch schedule was going to be 32 days later. The hard stance produced a positive outcome here; the patch was available a full month earlier than it otherwise would have been. There is a lot of history between security researchers and big vendors, where the big vendor just delays and delays and delays while the bug is running around out in the wild. I really do hear what you're saying, and while I'm sympathetic to it, I think that it's much more likely that the Project Zero team adopted the 90-day policy specifically because of years and years of vendors playing push-the-deadline. If there was an industry history of vendors acting promptly in good faith, this wouldn't even be a thing, but the politics behind bug reporting and disclosure are really pretty mature at this point, and I really do think it's naive to just chalk it up to "Google wants to embarrass its competition and is playing dirty to do it".

andyrj 12y ago

Google expended their resources to find a flaw in a MS product, in which MS was treated as any other vendor. If MS requires the ability to dictate the time alloted to fix their own mistakes, and are unwilling to change their own internal priorities for the sake of their own user base. Then perhaps, they should have found and fixed this prior to Google needing to point it out for them? I am amazed at the blind hatred for Google on this when MS has had a less than spectacular performance with its patches in the last year. Did all the MS fanbois forget about the bsod's just a few months back from MS's own "flawless", as you all seem to believe, patch schedule? (MS14-045 and MS13-036) If this deadline, self imposed by MS, is so greatly beneficial to MS patching why didn't the magic of patch Tuesday prevent those incidents?

jrockway 12y ago

I'm looking forward to the "Scroogled" ads and merchandise highlighting this issue.

fixermark 12y ago

Turning the question on its ear a bit: Even given that Windows 8.1 is a large and complicated machine, what was it about this particular bug that required basically all of Q4 for MS to patch it? It's one bug. I have a sinking suspicion that MS simply didn't consider it a priority, even after responsible disclosure to them, which is why it's good that Google's public disclosure policy is a hard-limit 90 days. Too many companies, when given the option to choose their own priority tree over the priority tree enforced by security needs, will choose the former.

sgdread 12y ago

You think that 2 days is nothing, but look at this from other perspective: first time MS asks for 2 days (BTW, as others pointed, initially MS said it's not going to be fixed until Feb), next time they ask for a week: last time you gave us 92 days, couldn't you wait for another 3 days? And then it goes, and goes. Then other company asks for a week. If google refuses, there will be unfair treatment and might cause bad press (much worse than this one). So as despite it looked like a dick move, I fully support google's actions. If you compromise on policy once, you're done. So 90 days is a 90 days, no matter what. I think it was a lesson to MS: take this policy with respect and avoid this in future. I'm a software developer and I know how difficult to fix big systems like Windows (burocracy must be crazy there), but the only way to challenge broken processes is to put pressure, otherwise it will never change.

wnevets 12y ago

Hasnt Microsoft released "out of band" patches before? Why is this one so special?

danielweber 12y ago
Out of band happens when there is a security issue actively being exploited in the wild.

dogpa 12y ago

Microsoft has been shipping steaming crapola for decades. Their unwieldy and unmaintainable codebase is their own fault. This should not be news to anyone who is unfortunate enough to have to use their awful products. They sought to dominate the market by means other than having the best talent and shipping the best software. It worked but now they have a problem. And who can forget this? http://blog.zorinaq.com/?e=74 http://blog.zorinaq.com/?e=74 Developers developers developers. Any vulns I find will not be dealt with in such a charitable manner. (i.e. you have exactly zero days to fix your shit). Why on Earth are Google wasting their own resources doing Microsoft's work for them? Tiny, tiny violins, Microsoft. Tiny, tiny violins.

realcul 12y ago

Google please fix your issues [1] before you leak zero day issues about your competitor... [1] http://www.zdnet.com/article/google-stops-providing-patches-for-pre-kitkat-webview-abandons-930m-users/ http://www.zdnet.com/article/google-stops-providing-patches-...

divs1210 12y ago

Microsoft will be celebrating a lot of Merge Days[1]. [1]: http://thedailywtf.com/articles/Happy_Merge_Day http://thedailywtf.com/articles/Happy_Merge_Day!