Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the security content of Security Update 2018-001

support.apple.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: About the security content of Security Update 2018-001

#11

Post by rurban »

PakG1 wrote: post #8
awat wrote: post #5

Earlier quoted context omitted.

In the support article Apple is crediting one of the CVEs “CVE-2018-4206: Ian Beer of Google Project Zero”

Title could still be better than it is, I think. Original title is much better. Things like attribution can be done fine in the comments if that's not in the title. Furthermore, Project Zero was involved in only one of the CVEs anyway then. Why not put the other credit in the title too? CVE-2018-4187: Zhiyang Zeng (@Wester) of Tencent Security Platform Department, Roman Mueller (@faker_)

Correct. And I would rather emphasise Tencent more. They did amazing security work in recent years, to me more impressive work than Google zero.

Re: About the security content of Security Update 2018-001

#12

Post by 0xFFFF0000 »

epistasis wrote: post #10

Google's PR machine strikes again, robbing Tencent of their due.

Exactly what I thought. Project Zero allows Google to segway away from their Android ecosystem mess they left beyind and (even relatively benign findings at times - there was a Defense in Depth issue in Windows recently I remember that got an article) get a lot of media attention, and other researches are ignored. Shows that Google's PR works really well. I first noticed that during Meltdown/Spectre where most of the heavy lifting was done by university students somewhere in Europe, but they nowhere got as much attention as Google. Sad.

Re: About the security content of Security Update 2018-001

#14

Post by 0xFFFF0000 »

ehsankia wrote: post #7
CognitiveLens wrote: post #2

For anyone unfamiliar with Project Zero, it's a team at Google dedicated to finding security vulnerabilities across the internet (and in software in general, it seems) https://security.googleblog.com/2014/07/announcing-project-z...

Some high profile exploits they either discovered or played a big role in: - SHAttered(?) - Row hammer - Cloudbleed - Lastpass exploit - Meltdown & Spectre

Would be good to also highlight the other finders of some of these issues, but this view shows that Google Project Zero is a well executed PR machine taking away the focus of other security researchers. The title of this thread is similarly misleading.

Re: About the security content of Security Update 2018-001

#15

Post by y4mi »

ehsankia wrote: post #7
CognitiveLens wrote: post #2

For anyone unfamiliar with Project Zero, it's a team at Google dedicated to finding security vulnerabilities across the internet (and in software in general, it seems) https://security.googleblog.com/2014/07/announcing-project-z...

Some high profile exploits they either discovered or played a big role in: - SHAttered(?) - Row hammer - Cloudbleed - Lastpass exploit - Meltdown & Spectre

Why a question mark behind SHAttered?

> This result is the product of a long term collaboration between the Cryptology Group at Centrum Wiskunde & Informatica (CWI) - the national research institute for mathematics and computer science in the Netherlands - and the Google Research Security, Privacy and Anti-abuse Group. [...]

Re: About the security content of Security Update 2018-001

#16

Post by mafro »

Guys seriously.. Nobody is going to read a link titled "About the security content of Security Update 2018-001".

People need some kind of pointer about _why_ they might want to read a security update statement.

Granted the original title should have included Tencent's name too.

Re: About the security content of Security Update 2018-001

#17

Post by ehsankia »

0xFFFF0000 wrote: post #14
ehsankia wrote: post #7

Earlier quoted context omitted.

Some high profile exploits they either discovered or played a big role in: - SHAttered(?) - Row hammer - Cloudbleed - Lastpass exploit - Meltdown & Spectre

Would be good to also highlight the other finders of some of these issues, but this view shows that Google Project Zero is a well executed PR machine taking away the focus of other security researchers. The title of this thread is similarly misleading.

To be clear, I state that "they played a role in", implying that there were other people too.

Re: About the security content of Security Update 2018-001

#18

Post by ehsankia »

y4mi wrote: post #15
ehsankia wrote: post #7

Earlier quoted context omitted.

Some high profile exploits they either discovered or played a big role in: - SHAttered(?) - Row hammer - Cloudbleed - Lastpass exploit - Meltdown & Spectre

Why a question mark behind SHAttered? > This result is the product of a long term collaboration between the Cryptology Group at Centrum Wiskunde & Informatica (CWI) - the national research institute for mathematics and computer science in the Netherlands - and the Google Research Security, Privacy and Anti-abuse Group. [...]

I know it was Google, but I wasn't sure if Google Research was the same as Google Project Zero or a different team.
Post reply on HN