5 ms·

What a disingenuous comparison. It's not "accede to our demands or we'll publish this information"; it's "we're publishing this information in 90 days whether y

What a disingenuous comparison. It's not "accede to our demands or we'll publish this information"; it's "we're publishing this information in 90 days whether you like it or not." If we ask "what gives any company the right to publish vulnerabilities about their competitors?" it's only a short step to asking "what gives journalists the right to publish scathing negative reviews?" The answer is the same: freedom of speech. It's a fact of life that if you want to fix security bugs, that takes time away from working on other things. If you don't like it, fix the bugs faster, or pay more attention to security from the get-go. Microsoft should be thanking Google for finding the bug in the first place.

freehunter 12y ago
It doesn't matter if Google publishes it after the patch. It matters if the publish before. If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. Google knew Microsoft had a patch. Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough". Journalists are not directly competing with tech companies. Google is. Imagine the next bug they find in Windows, and they publish it saying "ChromeOS doesn't have this bug!". They already use their search to push their browser, why not use their bug reporting to push their OS? When does free speech stop and anti-competitive behavior start? Would Google publish their own vulnerability if they were unable to fix it in 90 days?
- teraflop 12y ago
  > If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. So? As a general rule, people (and companies) have the right to say things like "I'll do X if you do Y" or "I'll do X unless you do Y". It becomes blackmail under certain circumstances, like where you're threatening to harm someone illegally, or demanding money for covering up a crime. In this case, Google picked a 90-day disclosure timeline which seems to be considered generally reasonable by the security community, so I don't see how they're doing anything wrong by sticking firmly to it. > Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough". Yup, sounds like competition to me. > Imagine the next bug they find in Windows, and they publish it saying "ChromeOS doesn't have this bug!". Yup, sounds like competition to me. Maybe I'm just being dense but it would help if you could explain why you think this is "anti-competitive." To me, forbidding a company from trying to demonstrate that its product is more secure than its competitors' is anti-competitive. > Would Google publish their own vulnerability if they were unable to fix it in 90 days? Maybe, maybe not. Presumably since Microsoft has so many employees and cares so much about security, it has its own team of researchers dedicated to finding bugs in Chrome, right? Or is it Google's responsibility to find everyone's bugs, and then give them as much time as they want to fix them?
  - WorldWideWayne 12y ago
    > It becomes blackmail under certain circumstances, like where you're threatening to harm someone [illegally?]... As a general rule, if I take action A and action A will result in a higher probability of harm coming to anyone, whether it's illegal or not...I'm a bad guy. Whether you call it blackmail or not, Google is the bad guy here. > Yup, sounds like competition to me. Oh good. I hope you can still apply the same logic if your personal bank gets attacked and your money is stolen because of the fact that Google decided to release detailed information to the mafia. > ...explain why you think this is "anti-competitive."...forbidding a company from trying to demonstrate that its product is more secure... That's not what's happening here. Google is not demonstrating any product here. The guy who runs Project Zero stated that “People deserve to use the internet without fear that vulnerabilities out there can ruin their privacy with a single website visit,”. Do you think Google's action here has resulted in more or less of a probability of harm coming to users here?

freehunter 12y ago

It doesn't matter if Google publishes it after the patch. It matters if the publish before. If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. Google knew Microsoft had a patch. Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough". Journalists are not directly competing with tech companies. Google is. Imagine the next bug they find in Windows, and they publish it saying "ChromeOS doesn't have this bug!". They already use their search to push their browser, why not use their bug reporting to push their OS? When does free speech stop and anti-competitive behavior start? Would Google publish their own vulnerability if they were unable to fix it in 90 days?

teraflop 12y ago
> If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. So? As a general rule, people (and companies) have the right to say things like "I'll do X if you do Y" or "I'll do X unless you do Y". It becomes blackmail under certain circumstances, like where you're threatening to harm someone illegally, or demanding money for covering up a crime. In this case, Google picked a 90-day disclosure timeline which seems to be considered generally reasonable by the security community, so I don't see how they're doing anything wrong by sticking firmly to it. > Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough". Yup, sounds like competition to me. > Imagine the next bug they find in Windows, and they publish it saying "ChromeOS doesn't have this bug!". Yup, sounds like competition to me. Maybe I'm just being dense but it would help if you could explain why you think this is "anti-competitive." To me, forbidding a company from trying to demonstrate that its product is more secure than its competitors' is anti-competitive. > Would Google publish their own vulnerability if they were unable to fix it in 90 days? Maybe, maybe not. Presumably since Microsoft has so many employees and cares so much about security, it has its own team of researchers dedicated to finding bugs in Chrome, right? Or is it Google's responsibility to find everyone's bugs, and then give them as much time as they want to fix them?
- WorldWideWayne 12y ago
  > It becomes blackmail under certain circumstances, like where you're threatening to harm someone [illegally?]... As a general rule, if I take action A and action A will result in a higher probability of harm coming to anyone, whether it's illegal or not...I'm a bad guy. Whether you call it blackmail or not, Google is the bad guy here. > Yup, sounds like competition to me. Oh good. I hope you can still apply the same logic if your personal bank gets attacked and your money is stolen because of the fact that Google decided to release detailed information to the mafia. > ...explain why you think this is "anti-competitive."...forbidding a company from trying to demonstrate that its product is more secure... That's not what's happening here. Google is not demonstrating any product here. The guy who runs Project Zero stated that “People deserve to use the internet without fear that vulnerabilities out there can ruin their privacy with a single website visit,”. Do you think Google's action here has resulted in more or less of a probability of harm coming to users here?