7 ms·

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additiona

• timonovici 12y ago
  What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?
  • smackfu 12y ago
    Does it really matter if it's 90 or 92 day disclosure?
    • cskau 12y ago
      Or you could ask: do two more days of the bug being secretly exploited in the wild matter?
      • Gigablah 12y ago
        As opposed to 2 days of the bug being openly exploited?
    • JumpCrisscross 12y ago
      > Does it really matter if it's 90 or 92 day disclosure? Yes. Google designed Project Zero to "pressure firms into dealing with security problems more quickly." A firm policy with unambiguous enforcement has its advantages. Muddying the 90-day deadline with questions about when (and for whom) to make exceptions weakens it. For example, in the future, I expect Microsoft will not wait the extra two days in the event of a security disclosure from Google. One may disagree with the 90-day policy to begin with. I, for one, think it should have had an exception process built in. But while these are Google policies, not laws, I respect them for adhering to published protocol. Even when it was difficult.
      • jenscow 12y ago
        I feel certain if this vulnerability had a higher impact (like remote execution) then it would have been over-ridden - or at least responded to quicker.
  • cmdkeen 12y ago
    What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits. Microsoft do issue out of band updates but they are very rare and for very serious issues. It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled releases. It's also worth pointing out the enterprises time things on the patch Tuesday cycle. An earlier release causes all sorts of implementation problems, especially if only a day or two in advance. In all likelihood you wouldn't see many machines actually updated in that period, but cause significant extra grief.
    • deleted 12y ago
      [deleted]
  • tarpherder 12y ago
    Almost everyone was already enjoying 90 days of ignorance. And almost everyone could have enjoyed indefinite ignorance with the same relative safety if Google had waited for patch Tuesday.
• fuj 12y ago
  Exactly this. Too bad some people's hatred towards MS blinds them.
• upofadown 12y ago
  Microsoft was actually asking for 92 days to fix the bug, not 2 days...
  • orf 12y ago
    And Google gave them a 90 day deadline. Doesn't seem right not to extend it by only two days, especially if there was a holiday period in between.
    • jbrooksuk 12y ago
      Who is Google to dictate to Microsoft when to release their patches?
      • jdjb 12y ago
        They're the ones doing the work of finding these vulnerabilities and being nice enough to report this to Microsoft (and the public) at all.
  • freehunter 12y ago
    Google gave them 90 days (by Google's policy). Microsoft had the fix, but asked for another 2 days in order to fit within their patching cycle. Google decided to take action outside of Microsoft's (well established) patch cycle. Then again what does Google care, they don't use or support anything Microsoft, so it doesn't affect them.
    • fixermark 12y ago
      Chrome runs on Windows. As does Google Earth, Google Drive, the android development toolchain, and a handful of other desktop clients that I'm not going to bother to look up right now.
• higherpurpose 12y ago
  So you're saying Google should make an exception for Microsoft? Its bestest friend ever? What about Facebook? Apple? Oracle? Why not just stop throw the 90 day rule out the window at that point, to fit everyone's schedules? It seems to me Microsoft is like that student who has 3 months to do a project, but waits until the last 2 days, and then asks the professor to give him some more time. It was Microsoft's responsibility to patch the bug at the last Patch Tuesday.
• iN7h33nD 12y ago
  I agree with this completely. Even if Google didn't know about patch days they should have allowed them two more days to release the patch since they asked for it. I would even say they could have given them another week window if they needed it. Releasing an exploit into the wild when you know a patch is coming is a really awe-full thing to do. If the tables were turned I wonder what Microsoft would have done here.
  • Corrado 12y ago
    And the next company that comes along will ask for 3 days, and then 5 days, etc. Pretty soon we're back to serious bugs not getting fixed until the vendor feels like it. The power of a set timeline is the fact that its not up to the vendor when things happen. They have proven time and again that they won't fix things until they are forced to; this forces them. It's just like being late for work. "But I was only 5 minutes late." Late is late.
    • freehunter 12y ago
      The last place I worked that cared if I was 5 minutes late to work was Wal-Mart when I was a teenager.
    • acqq 12y ago
      It's a kind of thinking of the bureaucrat and not of an engineer. I'm the later, and in my areas of work the tolerance of 10% is the default, the tolerance of 20% or 25% is also natural, and only something more than that is something that is even worth the words. As far as I know, some other engineering areas have even the safety factor of 2 or 3. That means, you expect the stress x, but your process has to sustain even 3 x. Edit: Zero tolerances are never a good idea. http://civilrightsproject.ucla.edu/research/k-12-education/school-discipline/opportunities-suspended-the-devastating-consequences-of-zero-tolerance-and-school-discipline-policies/ http://civilrightsproject.ucla.edu/research/k-12-education/s...
• wampus 12y ago
  There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesday is a restriction that Microsoft imposes on itself and its users. They had advanced warning and an opportunity to work within the limits of their own policy or roll out an unscheduled update. Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?).
  • _wmd 12y ago
    Given that Microsoft had excellent reason to ask for an extra 2 days, I guess the real question is that for a data-driven organization, why Google think 90 days is such a good number in the first place, and why they insisted on sticking to it despite the asinine alternative (forcing tens of thousands of IT departments to coordinate an out of band change for a low severity bug).
  • 300bps 12y ago
    A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process. Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?
  • forgottenpass 12y ago
    Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?). This looks like a solution, but isn't. Perhaps Google's 90 day deadline is already a re-evaluation of a 60-day deadline that was made to accommodate holidays and companies with a once-a-month patch schedule. If Google's deadline was 120 and still hit two days before patch Tuesday, would you say the same thing but for 150? (N.B. I'm not defending Google, just poking a hole in this particular idea.)
• dragonwriter 12y ago
  > By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third). Google doesn't dictate Microsoft's patch releasing policy. 90 days are 90 days. Microsoft doesn't have "only 60 days", they have 90 days like anyone else, and they chose to miss it by adhering to a policy of their own choosing that makes security patches less timely. The whole purpose of a fixed 90-day window is to give reasonable time to fix a security vulnerability but also to create pressure to do so timely. Making exceptions for vendors to accommodate existing policies that make security fixes less timely would both increase the effort for Google (as a fixed time window is always easier to implement than one that varies with each vendors policies) and undermine the whole purpose of the 90-day timeline.
  • deleted 12y ago
    [deleted]
  • acqq 12y ago
    It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.
    • _wmd 12y ago
      I wanted to say this, but evidently it was pointless given that seemingly 80% the people on this thread have absolutely no understanding of change management whatsoever, or more importantly the problems you might face when customers have your update infrastructure indirectly linked to national grids and industrial automation. Clearly Microsoft should just release Windows as a repo on GitHub and push fixes to master.
• santacluster 12y ago
  The "second-tuesday-of-the-month" policy is a completely arbitrary MS-only policy. If Google (or any other group that discovers security issues) has to take into account every policy of every software producer it becomes utterly impossible to have any disclosure policy. If MS wants to handicap themselves, that's their problem. The rest of the world doesn't have to bend to their will, those days are over. Yes, this is about being an ass. And it's Microsoft that's being an ass by claiming the rest of the world should take into account their peculiar policy.
  • Beltiras 12y ago
    The patch-day policy is not for Microsoft, it's for sysadmins who maintain the installations.
  • itg 12y ago
    The "90 days" policy is a completely arbitrary Google-only policy. There is no reason they couldn't wait a bit longer before disclosing.
  • eropple 12y ago
    Have you ever managed a nontrivial installation of user-facing desktop systems? 'Cause if not, declaring the policy of a predictable, telegraphed-well-in-advance day on which security patches will drop "peculiar" kind of just reveals where your head's at.
    • jenscow 12y ago
      The rate at which security vulnerabilities are reported/abused isn't predictable. Please don't sit on a fix until the time is more "convenient", give it to me now and let me be the judge on how important this security patch is to me.
      • Robin_Message 12y ago
        Because the patch can easily be reversed into the exploit, it has to be convenient for everyone in the herd to apply it at the same time unfortunately.