5 ms·

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples priorities. There is a published 90 day policy, they gave 90 days notice, figure it out. There is also details missing about the communication between Google and Microsoft. Like when they asked for an extension, etc.

smackfu 12y ago
Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.
- deleted 12y ago
  [deleted]
- michaelt 12y ago
  The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness. You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...
gtirloni 12y ago
If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.
- tomiko_nakamura 12y ago
  If you start making exceptions, everyone will want one.
  - matwood 12y ago
    When you are the largest provider of the worlds desktop OS, you get exceptions.
    - kstrauser 12y ago
      Apparently not.
    - Mikeb85 12y ago
      You shouldn't. The world's largest OS supplier should have the manpower to fix bugs in a timely fashion.
    - tomiko_nakamura 12y ago
      Well, they thought so too. And it turned not to be true. And now they're blaming the others.
- comboy 12y ago
  It's the opposite of bureaucracy. Strict simple rule cuts the bureaucracy off. If you don't have it, then you have a lot of time wasted on communication, handling special exceptions, making decisions if you should bend it or not and so on.
- dragonwriter 12y ago
  > If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself. Its worth noting, as pointed out upthread, that the only reason it was released in January at all was because when Microsoft asked if their planned February release was going to cause a problem with the 90-day deadline, Google informed them the the 90-day deadline for that bug was 11 January and that that's when disclosure would occur. Clearly, the fixed deadline already achieved part of what it was intended to -- encouraging vendors to fix security issues more quickly. And I'm not sure that there even exists such a thing as a "common sense exception" to that policy, but extending it simply to accommodate a vendor schedule that delays releases of security fixes to predetermined dates isn't such a common sense exception even if any exist. Its simply favoring the bureaucracy of fixed patch schedules over the purpose of the disclosure policy, which is encouraging vendors to more timely release fixes for security bugs.
- golemotron 12y ago
  Google is all about 'the algorithm' - it's organizational DNA.
Beltiras 12y ago
Here's an idea. Knowing Redmond's schedule, could they have notified them but set the disclosure date 2 days ahead? That seems like professional courtesy.
Igglyboo 12y ago
Zero tolerance policies are never a good idea, there's always some exception that seems far fetched until it actually happens that proves this.
jeletonskelly 12y ago
It's not about bending to another company's internal policy. It's about having etiquette for the company patching the vulnerability that extends beyond the basic rules; especially when it could harm users. What Google did certainly stayed within normal policy, but that doesn't make it good form.
sixothree 12y ago
I wonder how many Android devices out there are missing security updates.
- divegeek 12y ago
  None that Google can update.

smackfu 12y ago

Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.

deleted 12y ago
[deleted]
michaelt 12y ago
The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness. You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...

gtirloni 12y ago

If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

tomiko_nakamura 12y ago
If you start making exceptions, everyone will want one.
- matwood 12y ago
  When you are the largest provider of the worlds desktop OS, you get exceptions.
  - kstrauser 12y ago
    Apparently not.
  - Mikeb85 12y ago
    You shouldn't. The world's largest OS supplier should have the manpower to fix bugs in a timely fashion.
  - tomiko_nakamura 12y ago
    Well, they thought so too. And it turned not to be true. And now they're blaming the others.
comboy 12y ago
It's the opposite of bureaucracy. Strict simple rule cuts the bureaucracy off. If you don't have it, then you have a lot of time wasted on communication, handling special exceptions, making decisions if you should bend it or not and so on.
dragonwriter 12y ago
> If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself. Its worth noting, as pointed out upthread, that the only reason it was released in January at all was because when Microsoft asked if their planned February release was going to cause a problem with the 90-day deadline, Google informed them the the 90-day deadline for that bug was 11 January and that that's when disclosure would occur. Clearly, the fixed deadline already achieved part of what it was intended to -- encouraging vendors to fix security issues more quickly. And I'm not sure that there even exists such a thing as a "common sense exception" to that policy, but extending it simply to accommodate a vendor schedule that delays releases of security fixes to predetermined dates isn't such a common sense exception even if any exist. Its simply favoring the bureaucracy of fixed patch schedules over the purpose of the disclosure policy, which is encouraging vendors to more timely release fixes for security bugs.
golemotron 12y ago
Google is all about 'the algorithm' - it's organizational DNA.

Beltiras 12y ago

Here's an idea. Knowing Redmond's schedule, could they have notified them but set the disclosure date 2 days ahead? That seems like professional courtesy.

Igglyboo 12y ago

Zero tolerance policies are never a good idea, there's always some exception that seems far fetched until it actually happens that proves this.

jeletonskelly 12y ago

It's not about bending to another company's internal policy. It's about having etiquette for the company patching the vulnerability that extends beyond the basic rules; especially when it could harm users. What Google did certainly stayed within normal policy, but that doesn't make it good form.

sixothree 12y ago

I wonder how many Android devices out there are missing security updates.

divegeek 12y ago
None that Google can update.