Microsoft hits out at Google team over bug report

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).

MS is a huge company with an immense installed base and they have to be understandably careful with pushing updates. Working with them to disclose vulnerability on their regular patch day really wouldn't be such a bad thing for either Google nor the end users, even more so as we're talking about two days here and there even was a holiday week in the timespan.

This is about being an ass and I see no advantages for end users.

Even if Microsoft had not responded to Google at all, they could have waited for full three patch days (again, MS' patch deployment timeline is very much public knowledge by now) before publicly disclosing the issue.

Re: Microsoft hits out at Google team over bug report

#6

Post by shoggs » Mon, Jan 12, 2015, 2:09 PM UTC

nodata wrote: post #3

Beltiras wrote: post #2

2 days leeway is not uncalled for. Bad form Google.

Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).

Apparently Microsoft needed some time for testing.

Re: Microsoft hits out at Google team over bug report

#7

Post by pilif » Mon, Jan 12, 2015, 2:10 PM UTC

nodata wrote: post #3

Beltiras wrote: post #2

2 days leeway is not uncalled for. Bad form Google.

Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).

If Google insists on exactly 90 days without any consideration for patch Tuesdays, this means that, if unlucky, MS will only get 60 days (if they got the announcement right after a patch Tuesday)

Re: Microsoft hits out at Google team over bug report

#8

Post by majc2 » Mon, Jan 12, 2015, 2:10 PM UTC

nodata wrote: post #3

Beltiras wrote: post #2

2 days leeway is not uncalled for. Bad form Google.

Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).

And they asked for 92 days and Google decided to publish anyway? While I'm not surprised, it doesn't strike me as the most responsible action.

Re: Microsoft hits out at Google team over bug report

#9

Post by presootto » Mon, Jan 12, 2015, 2:11 PM UTC

Google is just a bunch of hypocrites. Do you remember what happened when they're new ReCaptcha was reverse engineered?

Let me remind you: https://news.ycombinator.com/item?id=8728336

Disclaimer: I work for TAGA (The Arrogant Google Assholes)

Re: Microsoft hits out at Google team over bug report

#10

Post by spydum » Mon, Jan 12, 2015, 2:11 PM UTC

Beltiras wrote: post #2

2 days leeway is not uncalled for. Bad form Google.

unlikely we will know the true internal discussion, but it seems unlikely it realistically took MSFT 92 days to put together a patch.

It seems far more likely they sat on the disclosure and did not prioritize it appropriately, after google continued to push for an estimated release date (which they never got). Then when the clock was running out, MSFT asked for extension, and Google being tired of getting put off, said no and stuck to their 90-day policy.

all of the above is speculation, and I don't necessarily agree it was the right thing to do. However, I could see folks @ googles sec group being a bit pissed MSFT wasnt taking it seriously, and then decided to stand on their policy just to make an example (surely, MSFT wont drag feet on future disclosures after this, right?).