8 ms·

Doubling the deadline to 180 days is probably reasonable IMO.

by yuhong 12y ago

markcerqueira 12y ago
Might be, but I'm sure if it's important they would allocate resources to getting it fixed ASAP. I doubt the fix for this and testing takes 90 days, or even 45 days.
- rinon 12y ago
  This apparently _does_ take that long, but should absolutely not.
  - markcerqueira 12y ago
    Right. If they extended it to 180 days, it would take them 200 days to fix it. 365 days ~> 400 days.
  - higherpurpose 12y ago
    Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period. If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).
    - teraflop 12y ago
      Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/list?can=1&sort=-id https://code.google.com/p/google-security-research/issues/li... What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed. https://code.google.com/p/google-security-research/issues/detail?id=111 https://code.google.com/p/google-security-research/issues/de... https://code.google.com/p/google-security-research/issues/detail?id=113 https://code.google.com/p/google-security-research/issues/de...
    - Amezarak 12y ago
      There are other bugs not reported by Google that Microsoft has to investigate and resolve as well. I doubt Google is the primary channel of security bug reports.
- fname 12y ago
  From the comments in the article Microsoft informed us that a fix was planned for the January patches but has to be pulled due to compatibility issues. Therefore the fix is now expected in the February patches. So, they met the deadline and fixed the vulnerability, but due to compatibility issues had to pull it before being released through Windows Update.
  - modeless 12y ago
    ... so they didn't meet the deadline. The deadline is for a released fix, not a theoretical fix that nobody can install in reality. They could, and should, speed up their process. But they won't, unless they get pressure from outside.
    - wideroots 12y ago
      ...yea it's easy to say when most people here should know how hard it is to ship any complicated system on multiple platforms. Actually, just making an app work for all major versions of Android could be a nightmare. And...what do you mean "they won't speed up their process"? Microsoft has released zero-day security bug fixes less than 90 days so many times before.
      - modeless 12y ago
        I didn't say it was easy. I said Microsoft could do it, and that's true. Microsoft can do hard things, if it's a priority for them. Apparently they've judged that the damage isn't worth prioritizing these fixes higher.
      - Dylan16807 12y ago
        'making a program work' can easily be half your development time, or even more if you don't put on a lot of polish. But this is bugfixing, not creating new programs. It shouldn't take this long.
comboy 12y ago
Half a year? I wouldn't assume these guys at Google are the only ones discovering these vulnerabilities. Longer period won't improve Windows security. All it can do is keep better image of MS.
higherpurpose 12y ago
Other companies fix such bugs in days.
- uniformlyrandom 12y ago
  Other companies do not develop enterprise operating systems.
  - beedogs 12y ago
    Yep, Microsoft's the only one.
  - SolarNet 12y ago
    How is that a reasonable excuse? If they have so much money their operating system should be fixed faster, not slower, than other operating systems.
    - nkozyra 12y ago
      More money (or resources) = faster solutions is a pretty common fallacy. Often the size, scope and wealth of resources induces an increasingly slower response to such things.
      - Dylan16807 12y ago
        How is it a fallacy? Because management is incompetent? If your budget goes from 1M to 10M even a child could show you how to spend 1M and throw the rest into a big fire or something. Maybe run two agile teams at 1M each.
        anon1385 12y ago
        I honestly can't tell if you are attempting parody or being serious.
        12y ago
amaks 12y ago
Whatever time frame Google would come up with Microsoft would still find a reason to delay past it and publicly cry out loud.
- majc2 12y ago
  This is conjecture and frankly nonsense. If the time frame was 5 years, would MS really find a reason to delay and to publicly cry out loud? No. The only org being unreasonable is big G.
- lkbm 12y ago
  My understanding was that Microsoft had a specified timeline. Do you have reason to believe it's derived from Google's timeline? If Microsoft says "100 days", saying "okay" instead of " no, 90" gives a timeline 100 days, not 101.

Doubling the deadline to 180 days is probably reasonable IMO.

by yuhong 12y ago

Doubling the deadline to 180 days is probably reasonable IMO.

Might be, but I'm sure if it's important they would allocate resources to getting it fixed ASAP. I doubt the fix for this and testing takes 90 days, or even 45 days.

rinon 12y ago
This apparently _does_ take that long, but should absolutely not.
- markcerqueira 12y ago
  Right. If they extended it to 180 days, it would take them 200 days to fix it. 365 days ~> 400 days.
- higherpurpose 12y ago
  Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period. If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).
  - teraflop 12y ago
    Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/list?can=1&sort=-id https://code.google.com/p/google-security-research/issues/li... What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed. https://code.google.com/p/google-security-research/issues/detail?id=111 https://code.google.com/p/google-security-research/issues/de... https://code.google.com/p/google-security-research/issues/detail?id=113 https://code.google.com/p/google-security-research/issues/de...
  - Amezarak 12y ago
    There are other bugs not reported by Google that Microsoft has to investigate and resolve as well. I doubt Google is the primary channel of security bug reports.
fname 12y ago
From the comments in the article Microsoft informed us that a fix was planned for the January patches but has to be pulled due to compatibility issues. Therefore the fix is now expected in the February patches. So, they met the deadline and fixed the vulnerability, but due to compatibility issues had to pull it before being released through Windows Update.
- modeless 12y ago
  ... so they didn't meet the deadline. The deadline is for a released fix, not a theoretical fix that nobody can install in reality. They could, and should, speed up their process. But they won't, unless they get pressure from outside.
  - wideroots 12y ago
    ...yea it's easy to say when most people here should know how hard it is to ship any complicated system on multiple platforms. Actually, just making an app work for all major versions of Android could be a nightmare. And...what do you mean "they won't speed up their process"? Microsoft has released zero-day security bug fixes less than 90 days so many times before.
    - modeless 12y ago
      I didn't say it was easy. I said Microsoft could do it, and that's true. Microsoft can do hard things, if it's a priority for them. Apparently they've judged that the damage isn't worth prioritizing these fixes higher.
    - Dylan16807 12y ago
      'making a program work' can easily be half your development time, or even more if you don't put on a lot of polish. But this is bugfixing, not creating new programs. It shouldn't take this long.

comboy 12y ago

Half a year? I wouldn't assume these guys at Google are the only ones discovering these vulnerabilities. Longer period won't improve Windows security. All it can do is keep better image of MS.

higherpurpose 12y ago

Other companies fix such bugs in days.

uniformlyrandom 12y ago
Other companies do not develop enterprise operating systems.
- beedogs 12y ago
  Yep, Microsoft's the only one.
- SolarNet 12y ago
  How is that a reasonable excuse? If they have so much money their operating system should be fixed faster, not slower, than other operating systems.
  - nkozyra 12y ago
    More money (or resources) = faster solutions is a pretty common fallacy. Often the size, scope and wealth of resources induces an increasingly slower response to such things.
    - Dylan16807 12y ago
      How is it a fallacy? Because management is incompetent? If your budget goes from 1M to 10M even a child could show you how to spend 1M and throw the rest into a big fire or something. Maybe run two agile teams at 1M each.
      - anon1385 12y ago
        I honestly can't tell if you are attempting parody or being serious.
        12y ago

amaks 12y ago

Whatever time frame Google would come up with Microsoft would still find a reason to delay past it and publicly cry out loud.

majc2 12y ago
This is conjecture and frankly nonsense. If the time frame was 5 years, would MS really find a reason to delay and to publicly cry out loud? No. The only org being unreasonable is big G.
lkbm 12y ago
My understanding was that Microsoft had a specified timeline. Do you have reason to believe it's derived from Google's timeline? If Microsoft says "100 days", saying "okay" instead of " no, 90" gives a timeline 100 days, not 101.