Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A walk through Project Zero metrics

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

11–20 of 62 posts

Re: A walk through Project Zero metrics

#11

Post by tptacek »

lima wrote: post #9
tptacek wrote: post #8

This will sound very weird, but I kind of hate that they include Google among the vendors they report to, provide a deadline and grace period for, and track responses from. It's actually not their responsibility to do anything like that; if Microsoft and Apple are unhappy that P0 is targeting them, they should respond by standing up their own P0 teams and hammering Google, rather than having everyone operate under th…

Why not? It really strengthens the message.

I don't think it does strengthen the message, unless you think Google does such a good job responding to P0 that they're setting a standard Microsoft, Apple, and Adobe have to adhere to, and I think that's pretty debatable (the really important thing P0 does to set a standard is the 90 day deadline).

Re: A walk through Project Zero metrics

#12

Post by [deleted] »

lima wrote: post #9
tptacek wrote: post #8

This will sound very weird, but I kind of hate that they include Google among the vendors they report to, provide a deadline and grace period for, and track responses from. It's actually not their responsibility to do anything like that; if Microsoft and Apple are unhappy that P0 is targeting them, they should respond by standing up their own P0 teams and hammering Google, rather than having everyone operate under th…

Why not? It really strengthens the message.

[deleted]

Re: A walk through Project Zero metrics

#13

Post by xxpor »

tptacek wrote: post #11
lima wrote: post #9

Earlier quoted context omitted.

Why not? It really strengthens the message.

I don't think it does strengthen the message, unless you think Google does such a good job responding to P0 that they're setting a standard Microsoft, Apple, and Adobe have to adhere to, and I think that's pretty debatable (the really important thing P0 does to set a standard is the 90 day deadline).

It prevents google execs from burying P0 reports to other teams at Google though, which seems like the bigger risk?

Re: A walk through Project Zero metrics

#14

Post by tptacek »

xxpor wrote: post #10
tptacek wrote: post #8

This will sound very weird, but I kind of hate that they include Google among the vendors they report to, provide a deadline and grace period for, and track responses from. It's actually not their responsibility to do anything like that; if Microsoft and Apple are unhappy that P0 is targeting them, they should respond by standing up their own P0 teams and hammering Google, rather than having everyone operate under th…

Could you expand more on why? At least to me, it seems like there's no downside to publicly tracking responses from Google itself. Ideally P0 should operate mostly independently. Agreed that there should be more P0 like efforts from other companies though. The more the merrier.

I guess I'd start by saying I don't see the advantage to P0 operating independently. Threads about P0 often devolve into debates about conflicts of interest, but there's no conflict here; every vendor has in principle the right to conduct lawful vulnerability research against other vendors, including competitors, and there's no ethical standard that dictates what those vendors should choose to target.

Google is, of course, ethically obligated to rigorously test its own products, and if P0 has expertise that the other security orgs at Google lacks, it's ethically obligated to train that expertise on Google products. I'm just saying that Google isn't ethically obligated to include itself in its vendor tracking statistics.

Re: A walk through Project Zero metrics

#15

Post by [deleted] »

tptacek wrote: post #8

This will sound very weird, but I kind of hate that they include Google among the vendors they report to, provide a deadline and grace period for, and track responses from. It's actually not their responsibility to do anything like that; if Microsoft and Apple are unhappy that P0 is targeting them, they should respond by standing up their own P0 teams and hammering Google, rather than having everyone operate under th…

[deleted]

Re: A walk through Project Zero metrics

#16

Post by shadowgovt »

tptacek wrote: post #14
xxpor wrote: post #10

Earlier quoted context omitted.

Could you expand more on why? At least to me, it seems like there's no downside to publicly tracking responses from Google itself. Ideally P0 should operate mostly independently. Agreed that there should be more P0 like efforts from other companies though. The more the merrier.

I guess I'd start by saying I don't see the advantage to P0 operating independently. Threads about P0 often devolve into debates about conflicts of interest, but there's no conflict here; every vendor has in principle the right to conduct lawful vulnerability research against other vendors, including competitors, and there's no ethical standard that dictates what those vendors should choose to target. Google is, of c…

I agree there's no obligation, but including it gives other people some assurance that P0 isn't going easy on its patron.

Re: A walk through Project Zero metrics

#18

Post by UncleMeat »

gsmith7890 wrote: post #17

What was the most serious vulnerability or set of vulnerabilities identified by Project Zero?

Spectre is probably the most interesting one. As of right now it isn't as critical as other things since it is difficult to actually exploit but its implications are gargantuan, similar to the development of return-oriented-programming a while back.

Re: A walk through Project Zero metrics

#19

Post by amscanne »

tptacek wrote: post #14
xxpor wrote: post #10

Earlier quoted context omitted.

Could you expand more on why? At least to me, it seems like there's no downside to publicly tracking responses from Google itself. Ideally P0 should operate mostly independently. Agreed that there should be more P0 like efforts from other companies though. The more the merrier.

I guess I'd start by saying I don't see the advantage to P0 operating independently. Threads about P0 often devolve into debates about conflicts of interest, but there's no conflict here; every vendor has in principle the right to conduct lawful vulnerability research against other vendors, including competitors, and there's no ethical standard that dictates what those vendors should choose to target. Google is, of c…

I don't think they are ethically obligated, but adds credibility to the idea that P0 is trying to improve security across the industry as a whole. Perhaps that makes their work easier because people are more receptive knowing that they are being treated "fairly" (at least in the same manner as the organization sponsoring the work).

Re: A walk through Project Zero metrics

#20

Post by Terry_Roll »

Kudos for the TLDR. Interesting to not that vendors are taking bugs more seriously. Intelligence wise, I wonder what P) learn from the communication that takes place between P0 & the vendor, ie are there lots of questions asked over time giving insight into thought processes or does P0 see a massive data grab and then communication silence until the bug is fixed?

For all software & hardware vendors, this will help raise the standards & revenue but it will also raise the barrier to entry for new entrants as sole developers or small teams will have to consider more than the basic function of their app/project/hw. Legislation like GDPR already means some projects may never get to fly today as regulatory burden is too great, and the bug front is another domain which is maturing adding to the burden.

Post reply on HN