7 ms·

So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicati

• nathanvanfleet 12y ago
  Well HN needs links to be submitted, and then voted up. So I guess to answer your question is that no one at HN cared?
  • cheepin 12y ago
    Yep, the collective "we" got what "we" wanted.
• deleted 12y ago
  [deleted]
• username223 12y ago
  I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this. Maybe there's a similar story with OS X, but there doesn't seem to be a public record of it.
  • Dylan16807 12y ago
    I really dislike your description because while it is technically true it heavily implies that they decided on dates on a per-bug case, when they decided on a flat 90 days.
    • erglkjahlkh 12y ago
      Then again, 90 days contains 2.5 of their fix cycles. If the vulnerability really is serious, and they can't fix it in that time line, they should exit the business.
      • din-9 12y ago
        As noted in the bug, it is not just writing a fix but writing one that works against all supported configurations that is the cause of a delay.
      • josteink 12y ago
        Google roughly supports one version of their product on 2 OSs. Microsoft supports all versions of all their products for 10years+ after release, integrated with a combination of all other products they have shipped in that same time-frame. Needless to say, Microsoft needs to do more QA on their bug-fixes before they can safely release it to all customers without the risk of causing new issues. It's easy for Google to be big in the mouth when they don't bother to support their existing customers properly. Speaking of being big in the mouth: Did you know that Google isn't back-porting security fixes to older versions of Android either (only 2 last minor releases)? I guess supporting more than 40% of your user base is too much work.</sarcasm> Guess which side my sympathy is leaning to in this case.
        • masklinn 12y ago
          > Needless to say, Microsoft needs to do more QA on their bug-fixes before they can safely release it to all customers without the risk of causing new issues. IIRC Microsoft also releases pre-versions of their patches to select customers so sysadmins can test the patch doesn't cause issues on their deployments.
  • ahoge 12y ago
    > [...] and discloses a zero-day. 90-day, you mean. It's only zero-day if they had zero days to come up with a solution. That's what "zero-day" means.
    • zabcik 12y ago
      But that doesn't sound nearly as cool or media hype-able.
    • deleted 12y ago
      [deleted]
      • ahoge 12y ago
        http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack > It is called a "zero-day" because the programmer has had zero days to fix the flaw
        • username223 12y ago
          Did you read what you just linked? Specifically, the part after the open parenthesis? The bit about the patch not being available? > It is called a "zero-day" because the programmer has had zero days to fix the flaw (in other words, a patch is not available). Please try again.
    • Truff 12y ago
      Actually, 0-day refers to the time since public disclosure.
      • ahoge 12y ago
        If that would be the case then we would have another term for the thing I just described, because that's the worst case scenario. Anyhow, the Wikipedia article disagrees with you, too. Got any sources for your definition?
    • username223 12y ago
  • goalieca 12y ago
    3 months is a long ass time to produce a patch.
    • aasarava 12y ago
      Even if we're talking about such a massive roll-out to millions of machines, with various versions of the OS running on various hardware? I don't know how easy or not the actual patch is to produce, but it's not out of the realm of possibilities that they did run into a compatibility issue that they wanted more time to sort out. Think of the outcry and damage to their business if they rolled out a patch that accidentally broke some installations.
      • lern_too_spel 12y ago
        Yes, even then. Imagine if the bug had been found by security researchers who believe in full disclosure. You think it's reasonable for Microsoft to allow dozens of rootkits and viruses to proliferate for more than three months, for botnets to grow to hundreds of millions in size? Microsoft's release process is broken.
        • tyree732 12y ago
          Sure, three months is a long time to fix an issue, but what does Microsoft have to gain by taking longer to fix an issue of this severity than it believes it needs to? If Microsoft released the fixes when they were going to, and Google then released the details of the issues and when they first reported them, Google could still make a stink about Microsoft's turn-around time on critical security bugs, and there wouldn't be any gap between global notification of the issues and a readily available fix for them. Put another way, Google may have just notified the world of black-hat hackers of an issue they weren't otherwise aware of, an issue that demonstrably will not be patched for some time. If that is the case, then Google just recklessly endangered people's computers in the interest of raising awareness of Microsoft's poor turn around time on these issues. There is also the very real chance that this issue was already known by the black-hat community, in which case there isn't nearly as much lost by reporting here, but that's a gamble Google is making in order to make a point.
  • higherpurpose 12y ago
    No, I think the "issue" is that Apple doesn't talk to the media, while Microsoft immediately complained to some big tech sites about it, which then wrote the story from Microsoft's point of view.
  • amaks 12y ago
    Think what you want, but IMO 90 days (even rounded to the nearest patch Tuesday) is plenty of time to fix the critical security issue. Clearly Microsoft is acting weird here.
  • Kalium 12y ago
    > others that Microsoft would just put off fixes forever if Google didn't do this. People wouldn't think that if MS didn't have a long history of doing exactly that.
    • throwawaykf05 12y ago
      What security fixes has Microsoft put off forever?
      • MertsA 12y ago
        They are obviously much better about this now but back when IE was the browser du jour there were tons of bugs that took ages for them to fix. http://blog.washingtonpost.com/securityfix/2007/01/critical_microsoft_mozilla_pat.html?nav=rss_blog http://blog.washingtonpost.com/securityfix/2007/01/critical_...
        • Kalium 12y ago
          Often they would dismiss a bug until someone exploited it to make a worm.
  • duncan_bayne 12y ago
    "Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this." ... and yet others think that both of those statements are true :)
• drzaiusapelord 12y ago
  Because a Windows zero-day is a major risk to our economic system as our business and governments infrastructures run on MS products for the most part. OSX just doesn't have that level of install base and for the most part its installed on consumer/residential equipment. Heck, most OSX shops I've been part of have bog standard Windows AD on the back-end. Windows, good or bad, is everywhere that matters. Google seems to think Windows is a poorly written php app where you can just change a line and walk away. Windows testing has to be top notch and handle a huge about of 3rd party software, libraries, and drivers. The 90 day deadline really speaks to how web devs think and not how application engineers with massive install bases on a variety of equipment and running a variety of software think. It does piss me off to be honest. MS isn't saying no to the updates its just saying, "We're doing them in 100 days, not 90 as out of band patches are really bad for the ecosystem and we need more time to certify our changes." Google is saying, "Fuck you. Buy an android tablet, microserfs." Imagine if Google found the Kaminsky DNS bug. The internet would have melted on day 91 when google told everyone, "Sorry, too bad." I think this kind of "fuck you" disclosure should only be for attacks that have been demonstrated to be in the wild. Now they will be in various crimepaks, botnets, and trojan droppers within hours.
  • mikekchar 12y ago
    I used to work on telephone switches. We had 31 million lines of code. I can't remember the entire details since it was over a decade ago, but I believe Bellcore required us to deploy fixes for 70% of all reported bugs within 30 days. We were a huge, fat-ass company with 5000 programmers working on the same project and managed this. 90 days is a lifetime to fix a security problem. The point behind having a deadline before publicly disclosing is that if one person has discovered a security problem, then some other people probably have as well. It is fair enough to give vendors time before you make disclosure but if the vendor is moving too slowly -- for whatever reason -- you want to give the consumers a chance to implement their own security work around. Because if you don't they are vulnerable. Giving Microsoft 90 days to fix an issue is fine. They can prioritize it anyway they want. If they think it is super urgent, they can almost certainly get a fix out. If they think it is not so urgent, then they don't have to make a fix -- but they know that the problem will be disclosed. Nowhere in Google's documentation of this problem do I see a massive issue. Google gave MS 90 days. MS found a fix but there was another bug so they couldn't meet the window. Google released the information. Nowhere do I see MS requesting more time or any indication that anybody in the process thinks that anything went badly at all. It didn't meet the disclosure deadline. That's just the way it goes sometimes.