9 ms·
I have a serious question. I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?
by BigChiefSmokem 12y ago
I have a serious question.
I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?
- slouch 12y agoMost of these Apple computers are owned by Google users.
- epistasis 12y agoAnd a large percentage of Google devs are Apple users. Edit: for the apparent doubter of this, see any number of articles about Google's 40,000 macs that they use as dev machines, for example: https://www.usenix.org/conference/lisa13/managing-macs-google-scale https://www.usenix.org/conference/lisa13/managing-macs-googl... http://www.theregister.co.uk/2013/11/27/google_mac_support/ http://www.theregister.co.uk/2013/11/27/google_mac_support/
- HeavenFox 12y agoGoogle Engineers mostly use their beefy workstations with a Google-flavored Ubuntu installed to code. Most engineers have Mac laptops though (at least my team), even though their use is quite limited (you cannot store code there, so mostly you have to ssh or remote desktop to your workstation) Source: worked there once
- gst 12y agoDid you use an IDE via X11 forwarding? Or did you just use Vim / Emacs?
- KerrickStaley 12y agoUsually NX or the like.
- Shebanator 12y agoThat is generally true, but not completely so. A number of android engineers develop directly on Mac, and all iOS app developers do so because there isn't an alternative. And there are some weird engineers like me who mount their linux disks on their macs via nfs and only use their linux boxes to do command line work (builds, running servers, etc.).
- deleted 12y ago[deleted]
- notatoad 12y agoGoogle's ads are so pervasive that they make money for just about every minute you use the internet. If your computer is infested with viruses you might turn it off and go outside, therefore it's in Google's best interests to invest in general computer security.
- stevenh 12y agoGoogle makes money off of ads. A common monetization method used by malware distributors is to secretly replace legitimate ads that get loaded on the machine (such as Google's) with their own. Doing this on every single web page visited by that machine for the rest of its existence, and multiplying that by hundreds of thousands of other infected machines out there, and multiplying THAT by the dozens of different black hat groups doing this simultaneously, it adds up to a lot of lost money for Google.
- BigChiefSmokem 12y agoI understand the ad thing but that idea applies to all software companies (because they want their own browsers and operating systems used by users), not just Google. To me it feels like they're throwing their competitors under the bus in this way as opposed to running slander campaigns or witty commercials like Samsung, Microsoft, and Apple do. I'm not saying this is their intention but that is the way it comes off and it cannot be good for their reputation. A non-profit organization funded by the entire tech industry would have more credibility.
- giovannibajo1 12y agoThey would fix any doubt if they began releasing bugs and exploits for Android as well.
- notatoad 12y agoBetter that they fix their own vulnerabilities than release them. They do offer a bug bounty for their own products, to encourage third parties to do to them exactly what they're doing to Apple and Microsoft.
- rtpg 12y agogood PR? Not everything has to be directly linked to selling ads, Google is a group of people. Some companies plant trees, Google has this, I guess.
- tedunangst 12y agoProject Zero appears to be generating mostly negative PR for Google (and MS and Apple). From a wider public perception standpoint, it's almost lose-lose all around.
- obstinate 12y agoWell, that's one perspective. There are a lot of people who believe that disclosure like what Google is practicing will ultimately increase the rate at which bugs are fixed and decrease the frequency of computers being compromised.
- tedunangst 12y agoI didn't say it was a bad thing, but the PR they're getting is independent of whether I like what they're doing.
- joncp 12y agoMaybe it's their way of fighting the Man. They're compelled, almost by force, to cooperate with the US and other governments in spying on their users. This seems like a way to offset that ethical load by taking away some of the tools those bad actors use as weapons. I know I'd do it if I were in their shoes.
- GFK_of_xmaspast 12y agoThey are The Man.
- ratsbane 12y ago"Don't be evil" means that sometimes you should do things for the good of the community without expectation of direct rewards. Maybe I'm idealistic and naive but I think that Google tries to live up to that.
- pjmlp 12y agoWere they following that when they closed all < 4.4 Android bugs?
- Too 12y agoThey get a valid excuse for reverse engineering their competitors products so they can copy their technology.
- Oletros 12y agoSometimes is difficult to catch the sarcasm, because it is sarcastic, isn't?
- geofft 12y agoI can think of a few: 1. Google uses Mac OS and Windows internally, they're a big enough company that even untargeted malware that hits a small percentage of systems costs them money (not to mention targeted malware), and they're also a big enough company that the amortized cost of Project Zero, across all employees, is affordable. 2. The top-notch researchers who find vulnerabilities in their server stack (Linux, etc.) also like looking at different OSes occasionally, and this is a way of recruiting and keeping them at Google, which leads to them disclosing and fixing Linux security issues internally while waiting on an external response. 3. They're unhappy with their software vendors not taking security and vulnerability response seriously, and they're trying to shift the popular consensus / Overton window on how seriously people should care and what the industry-standard response to reports should be.