Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Project Zero exposes unpatched Windows 10 lockdown bypass

zdnet.com

Post reply on HN
Print view View original

111–120 of 126 posts

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#111

Post by dang »

_o_ wrote: post #93
_o_ wrote: post #65

Earlier quoted context omitted.

Google has huge problem with GDPR, their whole bussiness model is standing on tracking users, they are only smart enough not to piss into the wind. Actually they know far more about you than FB, imagine that they have almost everything you have on your android phone. And let me explain "draft it". They lobbied. The proof for that is fb and ggl attack on Canada to prevent legalising something similar as GDPR. Please (…

When I will finally be able to speak my personal thoughts without beeing downvoted by fanboys with low self value who are bonding their self worth with a popular brand. Guys seriously, you need psychiatric care, you ARE WRONG but due to your own personal problems you are beeing pestilence to the world. It is simple to diagnose, just check your posts, if you are defending one brand, infront others you are flawed. Ever…

You're likely being downvoted because your comments break the site guidelines by being unsubstantive and/or uncivil. It's possible to make substantive points thoughtfully; when commenting here, please do that.

https://news.ycombinator.com/newsguidelines.html

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#112

Post by ocdtrekkie »

annabellish wrote: post #35
pookeh wrote: post #11

Earlier quoted context omitted.

Yeah so? Both involve tons of money.

One can have a material impact on people's security, and thus everything from financial stability to physical safety. The other results in some companies making less money via advertising than they otherwise would have. Both involve money, but let's not pretend that the more money involved, the more important something is.

A company being driven out of business by advertising practices, having to let their employees go, and merely hope they can find new jobs, certainly impacts their financial stability, and likely their physical safety.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#113

Post by bionoid »

laurentl wrote: post #48
bionoid wrote: post #45

Earlier quoted context omitted.

> They can't, and they'll learn it the hard way. I doubt it. The fines will be completely irrelevant, and they won't even need to notify more than 1% of their lawyers and lobbyists to ensure they can keep it up for the next decade.

GDPR fines can be up to 4% of a company’s turnover (at group level too, not just the turnover of the local subsidiary). Whether the courts will actually use the maximum fine remains to be seen, but on paper it’s enough to give you pause - 4% of revenues is a large chunk of money for anyone. I work for a large EU company and this possibility is taken very seriously.

All I'm saying is I don't think the result will be a real improvement to privacy or data safety. I think it'll be some adjustments on paper, then business as usual.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#114

Post by wglb »

IncRnd wrote: post #84
lvh wrote: post #46

Earlier quoted context omitted.

“Long before Microsoft could patch” meaning when Microsoft decided to cancel a patch Tuesday? If Microsoft decided that the correct patch cadence was quarterly or annually (because so much QA work goes into a release), does that change what a disclosure deadline should look like? Also in the bug you’re referring to, Google expresses surprise Microsoft let it get through because of the severity, and declined to commen…

> If Microsoft decided that the correct patch cadence was quarterly or annually (because so much QA work goes into a release), does that change what a disclosure deadline should look like? Microsoft uses a regular patch cadence so enterprise users can allocate the necessary resources for review and update of their computers. There are scores of enterprises that use tens of thousands or hundreds of thousands of comput…

With respect to Google shoulders that risk all by themselves, this is clearly not the case. If an attacker discovers this issue and discloses it, by your logic, the fault would be all theirs.

The fault is with the creator of the software, not the discoverer of the flaw.

This broken logic has been around since at least when "Stalking the Wily Hacker" was released. Those who make the error and release broken software and systems should be held accountable, instead of throwing teenagers in jail.

Don't release software, especially important software, unless it is finished.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#115

Post by Oletros »

ILikeConemowk wrote: post #31
dewiz wrote: post #27

Google, you have 90 days to stop tracking web users, then Windows will start asking desktop users if they would like to block tracking by filtering DNS requests

I would pay to see this happen. "Google, we believe in our user's right to privacy and are looking for ways to improve their experience on our platforms. Due to your non-compliance with the upcoming GDPR and past misdeeds we have classified all your services as spyware and will be protecting our users accordingly should you fail to address this matter in 90 days from now. Kisses, Microsoft."

" Due to your non-compliance with the upcoming GDPR "

Honest question, why is Google not in compliance with GDPR?

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#116

Post by Buge »

pbhjpbhj wrote: post #38
Buge wrote: post #26

Earlier quoted context omitted.

The right to freedom of speech means Google can say what they want when they want about the vulnerability, giving them the right to set a deadline. There are certainly companies doing much worse than setting 90 day deadlines. For example VUPEN, Hacking Team, and GrayKey selling undisclosed vulnerabilities to "good" governments, and other companies servicing the shadier governments[1]. [1] https://www.bloomberg.com/ne…

>The right to freedom of speech means Google ... Surely it means specific people employed by Google may "speak". Does the right extend to corporations?

Does freedom of speech extend to newspapers? Newspapers are corporations.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#117

Post by wdr1 »

bootloop wrote: post #110
bitmapbrother wrote: post #109

Google reported the issue to Microsoft on January 19. Microsoft confirmed the issue about three weeks later Microsoft should make a mental note that when you receive an email from a member of Google's Project Zero team you don't wait 3 weeks to respond.

Answering an email and confirming an issue is not really the same thing.

Microsoft should attempt to verify issues quicker than 3 weeks, particularly when all details are provided?

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#118

Post by bitmapbrother »

bootloop wrote: post #110
bitmapbrother wrote: post #109

Google reported the issue to Microsoft on January 19. Microsoft confirmed the issue about three weeks later Microsoft should make a mental note that when you receive an email from a member of Google's Project Zero team you don't wait 3 weeks to respond.

Answering an email and confirming an issue is not really the same thing.

If it takes 3 weeks to confirm an issue reported to you by a Project Zero team member, especially when they provide you a detailed report on how to replicate the exploit, then you need to optimize your process.

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#119

Post by _o_ »

dang wrote: post #111
_o_ wrote: post #93

Earlier quoted context omitted.

When I will finally be able to speak my personal thoughts without beeing downvoted by fanboys with low self value who are bonding their self worth with a popular brand. Guys seriously, you need psychiatric care, you ARE WRONG but due to your own personal problems you are beeing pestilence to the world. It is simple to diagnose, just check your posts, if you are defending one brand, infront others you are flawed. Ever…

You're likely being downvoted because your comments break the site guidelines by being unsubstantive and/or uncivil. It's possible to make substantive points thoughtfully; when commenting here, please do that. https://news.ycombinator.com/newsguidelines.html

As far as I have noticed, it always happens when you post criticism on rust, javascript, tesla or google (haven't tryed with apple, samsung,... maybe someone should, it would be a nice research). In past same was with FB and Microsoft while this improved and today you can criticise them without downvotes. I think, that it is a clear case of this: https://insight.kellogg.northwestern.edu/article/leave_my_br...

Re: Google's Project Zero exposes unpatched Windows 10 lockdown bypass

#120

Post by hello_asdf »

rasz wrote: post #71
dewiz wrote: post #27

Google, you have 90 days to stop tracking web users, then Windows will start asking desktop users if they would like to block tracking by filtering DNS requests

This could happen 10 years ago, today Microsoft embraced tracking and spying. Win 10 grabs more info about you than google.

It's unfortunate that this is necessary, but you can use this if you'd like to limit that a bit. You'll have to put it on your router or on your own dns server though, as I think Windows will ignore some hosts from the system file.

https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke...

Post reply on HN