15 ms·

Google discloses another Windows security issue after deadline exceeded

170 points by doe88 12y ago

deleted 12y ago
[deleted]
RogerL 12y ago
So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/list https://code.google.com/p/google-security-research/issues/li...
- nathanvanfleet 12y ago
  Well HN needs links to be submitted, and then voted up. So I guess to answer your question is that no one at HN cared?
  - cheepin 12y ago
    Yep, the collective "we" got what "we" wanted.
- deleted 12y ago
  [deleted]
- username223 12y ago
  I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this. Maybe there's a similar story with OS X, but there doesn't seem to be a public record of it.
  - Dylan16807 12y ago
    I really dislike your description because while it is technically true it heavily implies that they decided on dates on a per-bug case, when they decided on a flat 90 days.
    - erglkjahlkh 12y ago
      Then again, 90 days contains 2.5 of their fix cycles. If the vulnerability really is serious, and they can't fix it in that time line, they should exit the business.
      - din-9 12y ago
        As noted in the bug, it is not just writing a fix but writing one that works against all supported configurations that is the cause of a delay.
      - josteink 12y ago
        Google roughly supports one version of their product on 2 OSs. Microsoft supports all versions of all their products for 10years+ after release, integrated with a combination of all other products they have shipped in that same time-frame. Needless to say, Microsoft needs to do more QA on their bug-fixes before they can safely release it to all customers without the risk of causing new issues. It's easy for Google to be big in the mouth when they don't bother to support their existing customers properly. Speaking of being big in the mouth: Did you know that Google isn't back-porting security fixes to older versions of Android either (only 2 last minor releases)? I guess supporting more than 40% of your user base is too much work.</sarcasm> Guess which side my sympathy is leaning to in this case.
        masklinn 12y ago
        > Needless to say, Microsoft needs to do more QA on their bug-fixes before they can safely release it to all customers without the risk of causing new issues. IIRC Microsoft also releases pre-versions of their patches to select customers so sysadmins can test the patch doesn't cause issues on their deployments.
- drzaiusapelord 12y ago
  Because a Windows zero-day is a major risk to our economic system as our business and governments infrastructures run on MS products for the most part. OSX just doesn't have that level of install base and for the most part its installed on consumer/residential equipment. Heck, most OSX shops I've been part of have bog standard Windows AD on the back-end. Windows, good or bad, is everywhere that matters. Google seems to think Windows is a poorly written php app where you can just change a line and walk away. Windows testing has to be top notch and handle a huge about of 3rd party software, libraries, and drivers. The 90 day deadline really speaks to how web devs think and not how application engineers with massive install bases on a variety of equipment and running a variety of software think. It does piss me off to be honest. MS isn't saying no to the updates its just saying, "We're doing them in 100 days, not 90 as out of band patches are really bad for the ecosystem and we need more time to certify our changes." Google is saying, "Fuck you. Buy an android tablet, microserfs." Imagine if Google found the Kaminsky DNS bug. The internet would have melted on day 91 when google told everyone, "Sorry, too bad." I think this kind of "fuck you" disclosure should only be for attacks that have been demonstrated to be in the wild. Now they will be in various crimepaks, botnets, and trojan droppers within hours.
  - mikekchar 12y ago
    I used to work on telephone switches. We had 31 million lines of code. I can't remember the entire details since it was over a decade ago, but I believe Bellcore required us to deploy fixes for 70% of all reported bugs within 30 days. We were a huge, fat-ass company with 5000 programmers working on the same project and managed this. 90 days is a lifetime to fix a security problem. The point behind having a deadline before publicly disclosing is that if one person has discovered a security problem, then some other people probably have as well. It is fair enough to give vendors time before you make disclosure but if the vendor is moving too slowly -- for whatever reason -- you want to give the consumers a chance to implement their own security work around. Because if you don't they are vulnerable. Giving Microsoft 90 days to fix an issue is fine. They can prioritize it anyway they want. If they think it is super urgent, they can almost certainly get a fix out. If they think it is not so urgent, then they don't have to make a fix -- but they know that the problem will be disclosed. Nowhere in Google's documentation of this problem do I see a massive issue. Google gave MS 90 days. MS found a fix but there was another bug so they couldn't meet the window. Google released the information. Nowhere do I see MS requesting more time or any indication that anybody in the process thinks that anything went badly at all. It didn't meet the disclosure deadline. That's just the way it goes sometimes.
eyeareque 12y ago
Hopefully this inspires change within Microsoft's development processes. Security issues are a big deal. While 90 days is difficult for them (and other companies), I'm sure with some investment on process improvement and or hiring more staff, they can get these fixes out faster. They owe it to their customers to do the right thing.
- icehawk219 12y ago
  Somehow I foresee Microsoft trying to rush out a security patch to a hugely complicated piece of software so it can be distributed to hundreds of millions of devices running countless hardware configurations just to appease Google ending very poorly for everyone but Google's marketing department.
  - eyeareque 12y ago
    Is it unreasonable to expect a company like Microsoft to be able to release a stable fix to protect their customers within 90 days?
- cjensen 12y ago
  Given that the holidays occurred during the 90-day period, and that Microsoft was paying attention and made a fix, and that testing found an issue with the fix, I think it would be reasonable for Google to give Microsoft an extension on the deadline. The statement that "if 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public" is little more than Google claiming the computer made them do it.
tszming 12y ago
In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-hitting-60-percent-of-android-phones/ http://arstechnica.com/security/2015/01/google-wont-fix-bug-...
- mahouse 12y ago
  They fixed those issues with 4.4.
  - immigrantsheep 12y ago
    and then you have tons of device who cannot upgrade to 4.4
    - krisgenre 12y ago
      Its the manufacturer's (HTC, Samsung ..) fault that they cannot be updated.
      - guardian5x 12y ago
        And Google, because they have not implemented a default update system for the android core. Google only updates Apps.
        SEMW 12y ago
        I'm honestly not sure what you're talking about. Android does have a system update mechanism. You go to settings -> About phone -> System updates. If manufacturers / carriers change that to check for updates on their own servers, rather than google's - which they can do since Android is open-source, and so they all do - then that's how the system update mechanism will work. I don't follow what you're suggesting google could do about that, apart from moving more and more OS functions out of the core OS and into google play services. Which is exactly what they've been doing.
deleted 12y ago
[deleted]
- pgodzin 12y ago
  Microsoft seems to be making a habit of not taking these vulnerabilities seriously enough, as this is the second time in the past few weeks that this has happened. 3 months is more than enough time to fix an important vulnerability that is potentially being exploited in that time period and longer. The threat of shouting it to the world should be enough to make it a top priority.
- eru 12y ago
  > That's a pretty high horse Google is on. Google is happy to receive security bug reports from any comers.
  - throwawaykf05 12y ago
    Yes, and then they ask people to sit on them longer when it's their ass on the line, something they won't do for Microsoft: https://news.ycombinator.com/item?id=8873898 https://news.ycombinator.com/item?id=8873898
    - lsaferite 12y ago
      So, since I'm in the dark beyond what the links say, what was the timeline for this disclosure? The github repo readme says "A few days ago, Google has introduced a new version of ReCaptcha" which seems to me like it was a 0-day disclosure. If that is the case why would it be hypocritical of Google to ask for the repo to come down so they have some time to fix the issue?
FesterCluck 12y ago
It should be noted as a point on this specific bug that, since wasn't fixed in the EXTRA time allotted and subsequently disclosed, this is a good thing. Impersonation is something that Windows Administrators can readily disable and manipulate via Group Policies and Active Directory. There's not a one-fix-for-all disable in this case, because impersonation is used in very nuanced ways. That being said, every organization can quickly and with a little effort tighten up their impersonation rights.
dkarapetyan 12y ago
Dick move by Google.
- amaks 12y ago
  Yeah, Google really should not really worry about discovering all those endless Windows vulnerabilities and let all those hacks (such as Sony's) to continue. Security by obscurity.
mrmondo 12y ago
As they should do, Microsoft is notoriously bad at security patching and have had more than enough time to issue a suitable fix. It won't be until we start doing this will all (closed sourced) vendors that'll we'll actually see improvements - otherwise what incentives for these company's are there? Making themselves look good is their primary objective, right next to sales.
deleted 12y ago
[deleted]
cLeEOGPw 12y ago
What I would like for Google to do is instead of publishing the details of the bug, after the deadline they would publish vague summary of vulnerability, so people would know it exists, but not quite able to exploit it right away. That would both inform people about danger and put pressure on MS, but without puting so much risk onto systems.
- hawleyal 12y ago
  That is not providing information about how to protect against the vulnerability regardless of a patch from Microsoft. Full disclosure is the only way to go.
NigerianPrince_ 12y ago
The first thing Microsoft does when they learn about a zero-day is to hand it to the NSA. Microsoft doesn't get to fix it until the NSA tells Microsoft they're done exploiting it. Google may be pissed about this. They've been pissed off before about NSA's shenanigans.
- WorldWideWayne 12y ago
  I suspect that Google is an NSA front organization, which is why Google appears to be pissed at the NSA. In any case, I think both Microsoft and Google would be high value targets for all sorts of infiltration by the NSA, whether it's sanctioned by the power structures of these companies or not.
  - 0xDOOD 12y ago
    So HN has gone from seeing Google's name on a PRISM slide, to assuming it's entirely an NSA outfit? Apple was on one of those slides. I suppose they're an NSA front organization as well?
    - WorldWideWayne 12y ago
      I'm just a single HN'er and I wasn't really thinking of PRISM... I was thinking more along the lines of how obviously valuable it would be to the NSA to either A) start companies like Google or B) infiltrate them. I also said that I suspect that's the case, not the I assume it to be. Given that the NSA seems to do what it wants and the obvious motivation for infiltrating or starting companies like Google...I think the suspicion is warranted.
nurb 12y ago
Google should ask money to keep it secret longer. Around 30 000$ a day IMO. Then give this money back to android device manufacturers scammed by Microsoft.
misterdai 12y ago
I can understand both points of view with the disclosure of the security issue. A while ago I discovered some security issues with Adobe ColdFusion and Railo. I wish I had put a deadline on disclosing the Adobe ColdFusion issues, as they dragged their feet so much (with admitting it was an issue and progressing with a fix) that at points I felt like throwing in the towel. Regrettably, instead of lighting a fire under their ass, I waited. At the time I was working on an open source side project, which would have pointed fingers towards where the issue was for any curious people. I ended up halting development of my project while I waited for Adobe, to the point where I no longer wanted to work on it. I had stopped for too long and I didn't want to dig anything else up. Having no legal type knowledge myself or knowing anyone who could offer such advice, I was also too concerned to reveal anything for fear or any legal reprise. So, the threat of security disclosure is warranted to pressure others into putting in the effort. However, the impact of the disclosure should be considered. If it will seriously affect others (who aren't responsible for the fix) and put them at risk, there should be the flexibility there to work with them on a deadline.
- sjwright 12y ago
  Did Railo fix the bug?
  - misterdai 12y ago
    They fixed one of the issues I reported. I don't believe I had official confirmation of the other issue I had with Railo being resolved. I probably should try it out again on their latest version, but I don't use Railo and haven't found myself with much fondness for ColdFusion either. But I should probably pull my thumb out and check ;)
sudioStudio64 12y ago
Everyone here seems to have this idea that MS should be able to validate and test a fix for all of their platforms and then publish it via their normal channels within the 90 days...That would actually mean that they only had 60+ days to get it fixed before the next patch Tuesday. But whatever, I just don't see why they can't work with MS to make sure that if a patch is in progress that the public disclosure gets delayed. This could end up going very badly for customers at some point in the near future. Could you imagine if google had published POC code for the SCHANNEL bug that came out lat year? You would have seen worms and new botnets immediately. That doesn't really help the situation. If they've committed to a fix, let them get it out before the public disclosure. In the end, MS has a support task that is unlike anything else in the tech industry. If they are trying to do the right thing, and they have really improved here, why beat them over the head with it?
danesparza 12y ago
What software is this for? Chrome? It's not clear from the bug report.
yuhong 12y ago
Doubling the deadline to 180 days is probably reasonable IMO.
- markcerqueira 12y ago
  Might be, but I'm sure if it's important they would allocate resources to getting it fixed ASAP. I doubt the fix for this and testing takes 90 days, or even 45 days.
  - rinon 12y ago
    This apparently _does_ take that long, but should absolutely not.
    - markcerqueira 12y ago
      Right. If they extended it to 180 days, it would take them 200 days to fix it. 365 days ~> 400 days.
    - higherpurpose 12y ago
      Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period. If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).
      - teraflop 12y ago
        Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/list?can=1&sort=-id https://code.google.com/p/google-security-research/issues/li... What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed. https://code.google.com/p/google-security-research/issues/detail?id=111 https://code.google.com/p/google-security-research/issues/de... https://code.google.com/p/google-security-research/issues/detail?id=113 https://code.google.com/p/google-security-research/issues/de...

170 points by doe88 12y ago

deleted 12y ago

[deleted]

So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/list https://code.google.com/p/google-security-research/issues/li...

nathanvanfleet 12y ago
Well HN needs links to be submitted, and then voted up. So I guess to answer your question is that no one at HN cared?
- cheepin 12y ago
  Yep, the collective "we" got what "we" wanted.
deleted 12y ago
[deleted]
username223 12y ago
I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this. Maybe there's a similar story with OS X, but there doesn't seem to be a public record of it.
- Dylan16807 12y ago
  I really dislike your description because while it is technically true it heavily implies that they decided on dates on a per-bug case, when they decided on a flat 90 days.
  - erglkjahlkh 12y ago
    Then again, 90 days contains 2.5 of their fix cycles. If the vulnerability really is serious, and they can't fix it in that time line, they should exit the business.
    - din-9 12y ago
      As noted in the bug, it is not just writing a fix but writing one that works against all supported configurations that is the cause of a delay.
    - josteink 12y ago
      Google roughly supports one version of their product on 2 OSs. Microsoft supports all versions of all their products for 10years+ after release, integrated with a combination of all other products they have shipped in that same time-frame. Needless to say, Microsoft needs to do more QA on their bug-fixes before they can safely release it to all customers without the risk of causing new issues. It's easy for Google to be big in the mouth when they don't bother to support their existing customers properly. Speaking of being big in the mouth: Did you know that Google isn't back-porting security fixes to older versions of Android either (only 2 last minor releases)? I guess supporting more than 40% of your user base is too much work.</sarcasm> Guess which side my sympathy is leaning to in this case.
      - masklinn 12y ago
        > Needless to say, Microsoft needs to do more QA on their bug-fixes before they can safely release it to all customers without the risk of causing new issues. IIRC Microsoft also releases pre-versions of their patches to select customers so sysadmins can test the patch doesn't cause issues on their deployments.
drzaiusapelord 12y ago
Because a Windows zero-day is a major risk to our economic system as our business and governments infrastructures run on MS products for the most part. OSX just doesn't have that level of install base and for the most part its installed on consumer/residential equipment. Heck, most OSX shops I've been part of have bog standard Windows AD on the back-end. Windows, good or bad, is everywhere that matters. Google seems to think Windows is a poorly written php app where you can just change a line and walk away. Windows testing has to be top notch and handle a huge about of 3rd party software, libraries, and drivers. The 90 day deadline really speaks to how web devs think and not how application engineers with massive install bases on a variety of equipment and running a variety of software think. It does piss me off to be honest. MS isn't saying no to the updates its just saying, "We're doing them in 100 days, not 90 as out of band patches are really bad for the ecosystem and we need more time to certify our changes." Google is saying, "Fuck you. Buy an android tablet, microserfs." Imagine if Google found the Kaminsky DNS bug. The internet would have melted on day 91 when google told everyone, "Sorry, too bad." I think this kind of "fuck you" disclosure should only be for attacks that have been demonstrated to be in the wild. Now they will be in various crimepaks, botnets, and trojan droppers within hours.
- mikekchar 12y ago
  I used to work on telephone switches. We had 31 million lines of code. I can't remember the entire details since it was over a decade ago, but I believe Bellcore required us to deploy fixes for 70% of all reported bugs within 30 days. We were a huge, fat-ass company with 5000 programmers working on the same project and managed this. 90 days is a lifetime to fix a security problem. The point behind having a deadline before publicly disclosing is that if one person has discovered a security problem, then some other people probably have as well. It is fair enough to give vendors time before you make disclosure but if the vendor is moving too slowly -- for whatever reason -- you want to give the consumers a chance to implement their own security work around. Because if you don't they are vulnerable. Giving Microsoft 90 days to fix an issue is fine. They can prioritize it anyway they want. If they think it is super urgent, they can almost certainly get a fix out. If they think it is not so urgent, then they don't have to make a fix -- but they know that the problem will be disclosed. Nowhere in Google's documentation of this problem do I see a massive issue. Google gave MS 90 days. MS found a fix but there was another bug so they couldn't meet the window. Google released the information. Nowhere do I see MS requesting more time or any indication that anybody in the process thinks that anything went badly at all. It didn't meet the disclosure deadline. That's just the way it goes sometimes.

eyeareque 12y ago

Hopefully this inspires change within Microsoft's development processes. Security issues are a big deal. While 90 days is difficult for them (and other companies), I'm sure with some investment on process improvement and or hiring more staff, they can get these fixes out faster. They owe it to their customers to do the right thing.

icehawk219 12y ago
Somehow I foresee Microsoft trying to rush out a security patch to a hugely complicated piece of software so it can be distributed to hundreds of millions of devices running countless hardware configurations just to appease Google ending very poorly for everyone but Google's marketing department.
- eyeareque 12y ago
  Is it unreasonable to expect a company like Microsoft to be able to release a stable fix to protect their customers within 90 days?
cjensen 12y ago
Given that the holidays occurred during the 90-day period, and that Microsoft was paying attention and made a fix, and that testing found an issue with the fix, I think it would be reasonable for Google to give Microsoft an extension on the deadline. The statement that "if 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public" is little more than Google claiming the computer made them do it.

tszming 12y ago

In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-hitting-60-percent-of-android-phones/ http://arstechnica.com/security/2015/01/google-wont-fix-bug-...

mahouse 12y ago
They fixed those issues with 4.4.
- immigrantsheep 12y ago
  and then you have tons of device who cannot upgrade to 4.4
  - krisgenre 12y ago
    Its the manufacturer's (HTC, Samsung ..) fault that they cannot be updated.
    - guardian5x 12y ago
      And Google, because they have not implemented a default update system for the android core. Google only updates Apps.
      - SEMW 12y ago
        I'm honestly not sure what you're talking about. Android does have a system update mechanism. You go to settings -> About phone -> System updates. If manufacturers / carriers change that to check for updates on their own servers, rather than google's - which they can do since Android is open-source, and so they all do - then that's how the system update mechanism will work. I don't follow what you're suggesting google could do about that, apart from moving more and more OS functions out of the core OS and into google play services. Which is exactly what they've been doing.

deleted 12y ago

[deleted]

pgodzin 12y ago
Microsoft seems to be making a habit of not taking these vulnerabilities seriously enough, as this is the second time in the past few weeks that this has happened. 3 months is more than enough time to fix an important vulnerability that is potentially being exploited in that time period and longer. The threat of shouting it to the world should be enough to make it a top priority.
eru 12y ago
> That's a pretty high horse Google is on. Google is happy to receive security bug reports from any comers.
- throwawaykf05 12y ago
  Yes, and then they ask people to sit on them longer when it's their ass on the line, something they won't do for Microsoft: https://news.ycombinator.com/item?id=8873898 https://news.ycombinator.com/item?id=8873898
  - lsaferite 12y ago
    So, since I'm in the dark beyond what the links say, what was the timeline for this disclosure? The github repo readme says "A few days ago, Google has introduced a new version of ReCaptcha" which seems to me like it was a 0-day disclosure. If that is the case why would it be hypocritical of Google to ask for the repo to come down so they have some time to fix the issue?

FesterCluck 12y ago

It should be noted as a point on this specific bug that, since wasn't fixed in the EXTRA time allotted and subsequently disclosed, this is a good thing. Impersonation is something that Windows Administrators can readily disable and manipulate via Group Policies and Active Directory. There's not a one-fix-for-all disable in this case, because impersonation is used in very nuanced ways. That being said, every organization can quickly and with a little effort tighten up their impersonation rights.

dkarapetyan 12y ago

Dick move by Google.

amaks 12y ago
Yeah, Google really should not really worry about discovering all those endless Windows vulnerabilities and let all those hacks (such as Sony's) to continue. Security by obscurity.

mrmondo 12y ago

As they should do, Microsoft is notoriously bad at security patching and have had more than enough time to issue a suitable fix. It won't be until we start doing this will all (closed sourced) vendors that'll we'll actually see improvements - otherwise what incentives for these company's are there? Making themselves look good is their primary objective, right next to sales.

deleted 12y ago

[deleted]

cLeEOGPw 12y ago

What I would like for Google to do is instead of publishing the details of the bug, after the deadline they would publish vague summary of vulnerability, so people would know it exists, but not quite able to exploit it right away. That would both inform people about danger and put pressure on MS, but without puting so much risk onto systems.

hawleyal 12y ago
That is not providing information about how to protect against the vulnerability regardless of a patch from Microsoft. Full disclosure is the only way to go.

NigerianPrince_ 12y ago

The first thing Microsoft does when they learn about a zero-day is to hand it to the NSA. Microsoft doesn't get to fix it until the NSA tells Microsoft they're done exploiting it. Google may be pissed about this. They've been pissed off before about NSA's shenanigans.

WorldWideWayne 12y ago
I suspect that Google is an NSA front organization, which is why Google appears to be pissed at the NSA. In any case, I think both Microsoft and Google would be high value targets for all sorts of infiltration by the NSA, whether it's sanctioned by the power structures of these companies or not.
- 0xDOOD 12y ago
  So HN has gone from seeing Google's name on a PRISM slide, to assuming it's entirely an NSA outfit? Apple was on one of those slides. I suppose they're an NSA front organization as well?
  - WorldWideWayne 12y ago
    I'm just a single HN'er and I wasn't really thinking of PRISM... I was thinking more along the lines of how obviously valuable it would be to the NSA to either A) start companies like Google or B) infiltrate them. I also said that I suspect that's the case, not the I assume it to be. Given that the NSA seems to do what it wants and the obvious motivation for infiltrating or starting companies like Google...I think the suspicion is warranted.

nurb 12y ago

Google should ask money to keep it secret longer. Around 30 000$ a day IMO. Then give this money back to android device manufacturers scammed by Microsoft.

misterdai 12y ago

I can understand both points of view with the disclosure of the security issue. A while ago I discovered some security issues with Adobe ColdFusion and Railo. I wish I had put a deadline on disclosing the Adobe ColdFusion issues, as they dragged their feet so much (with admitting it was an issue and progressing with a fix) that at points I felt like throwing in the towel. Regrettably, instead of lighting a fire under their ass, I waited. At the time I was working on an open source side project, which would have pointed fingers towards where the issue was for any curious people. I ended up halting development of my project while I waited for Adobe, to the point where I no longer wanted to work on it. I had stopped for too long and I didn't want to dig anything else up. Having no legal type knowledge myself or knowing anyone who could offer such advice, I was also too concerned to reveal anything for fear or any legal reprise. So, the threat of security disclosure is warranted to pressure others into putting in the effort. However, the impact of the disclosure should be considered. If it will seriously affect others (who aren't responsible for the fix) and put them at risk, there should be the flexibility there to work with them on a deadline.

sjwright 12y ago
Did Railo fix the bug?
- misterdai 12y ago
  They fixed one of the issues I reported. I don't believe I had official confirmation of the other issue I had with Railo being resolved. I probably should try it out again on their latest version, but I don't use Railo and haven't found myself with much fondness for ColdFusion either. But I should probably pull my thumb out and check ;)

sudioStudio64 12y ago

Everyone here seems to have this idea that MS should be able to validate and test a fix for all of their platforms and then publish it via their normal channels within the 90 days...That would actually mean that they only had 60+ days to get it fixed before the next patch Tuesday. But whatever, I just don't see why they can't work with MS to make sure that if a patch is in progress that the public disclosure gets delayed. This could end up going very badly for customers at some point in the near future. Could you imagine if google had published POC code for the SCHANNEL bug that came out lat year? You would have seen worms and new botnets immediately. That doesn't really help the situation. If they've committed to a fix, let them get it out before the public disclosure. In the end, MS has a support task that is unlike anything else in the tech industry. If they are trying to do the right thing, and they have really improved here, why beat them over the head with it?

danesparza 12y ago

What software is this for? Chrome? It's not clear from the bug report.

yuhong 12y ago

Doubling the deadline to 180 days is probably reasonable IMO.

markcerqueira 12y ago
Might be, but I'm sure if it's important they would allocate resources to getting it fixed ASAP. I doubt the fix for this and testing takes 90 days, or even 45 days.
- rinon 12y ago
  This apparently _does_ take that long, but should absolutely not.
  - markcerqueira 12y ago
    Right. If they extended it to 180 days, it would take them 200 days to fix it. 365 days ~> 400 days.
  - higherpurpose 12y ago
    Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period. If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).
    - teraflop 12y ago
      Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/list?can=1&sort=-id https://code.google.com/p/google-security-research/issues/li... What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed. https://code.google.com/p/google-security-research/issues/detail?id=111 https://code.google.com/p/google-security-research/issues/de... https://code.google.com/p/google-security-research/issues/detail?id=113 https://code.google.com/p/google-security-research/issues/de...