4 ms·

or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)

by jenscow 12y ago

mark_l_watson 12y ago
I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.
- fixermark 12y ago
  Of course, the thing about 0-days is that it's hard to say if those users wouldn't have been hurt anyway as the underground community exploited the known-only-to-them, Google, and Microsoft bug.
- kstrauser 12y ago
  That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.
  - WorldWideWayne 12y ago
    Sure it is. We know that less people knew the details before Google released the details. > Historically, it's more likely... But going on what is actually known, less people knew before Google's actions than after. EDIT: More accurately: We know that the information was definitely available after Google's action. We don't know that the information was definitely available before.
  - danielweber 12y ago
    > Historically, it's more likely that the vulnerability was already known among cracking circles, Why do you say this? It implies a world where software is almost perfectly secure, and there are only a few bugs to fix, and then it's perfectly secure, and we are all happy. In reality, there are effectively an infinite number of bugs out there, many with security holes. Finding one and going through the motions to fix, patch, test, and release still leaves you software with plenty of open holes. If you magically theorize "the bad guys know about all the holes already," then they are still going to exploit all the other holes in the system, because they magically know about them, too.

4 ms·

or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)

by jenscow 12y ago

or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)

mark_l_watson 12y ago
I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.
- fixermark 12y ago
  Of course, the thing about 0-days is that it's hard to say if those users wouldn't have been hurt anyway as the underground community exploited the known-only-to-them, Google, and Microsoft bug.
- kstrauser 12y ago
  That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.
  - WorldWideWayne 12y ago
    Sure it is. We know that less people knew the details before Google released the details. > Historically, it's more likely... But going on what is actually known, less people knew before Google's actions than after. EDIT: More accurately: We know that the information was definitely available after Google's action. We don't know that the information was definitely available before.
  - danielweber 12y ago
    > Historically, it's more likely that the vulnerability was already known among cracking circles, Why do you say this? It implies a world where software is almost perfectly secure, and there are only a few bugs to fix, and then it's perfectly secure, and we are all happy. In reality, there are effectively an infinite number of bugs out there, many with security holes. Finding one and going through the motions to fix, patch, test, and release still leaves you software with plenty of open holes. If you magically theorize "the bad guys know about all the holes already," then they are still going to exploit all the other holes in the system, because they magically know about them, too.