Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 165 posts

Re: Microsoft hits out at Google team over bug report

#21

Post by cmdkeen »

timonovici wrote: post #15
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?

What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits.

Microsoft do issue out of band updates but they are very rare and for very serious issues.

It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled releases. It's also worth pointing out the enterprises time things on the patch Tuesday cycle. An earlier release causes all sorts of implementation problems, especially if only a day or two in advance. In all likelihood you wouldn't see many machines actually updated in that period, but cause significant extra grief.

Re: Microsoft hits out at Google team over bug report

#22

Post by tarpherder »

timonovici wrote: post #15
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?

Almost everyone was already enjoying 90 days of ignorance. And almost everyone could have enjoyed indefinite ignorance with the same relative safety if Google had waited for patch Tuesday.

Re: Microsoft hits out at Google team over bug report

#23

Post by smackfu »

WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.

Re: Microsoft hits out at Google team over bug report

#24

Post by tomiko_nakamura »

pilif wrote: post #7
nodata wrote: post #3

Earlier quoted context omitted.

Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).

If Google insists on exactly 90 days without any consideration for patch Tuesdays, this means that, if unlucky, MS will only get 60 days (if they got the announcement right after a patch Tuesday)

So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.

Re: Microsoft hits out at Google team over bug report

#26

Post by gtirloni »

WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

Re: Microsoft hits out at Google team over bug report

#27

Post by [deleted] »

smackfu wrote: post #23
WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.

[deleted]

Re: Microsoft hits out at Google team over bug report

#28

Post by k-mcgrady »

*repost of my comment from another post on this subject[1]

>> "Google's Project Zero seeks to find bugs in popular software and then give the manufacturers responsible 90 days to fix the problem."

Seems reasonable.

>> "On 11 January, Google publicised the flaw. Microsoft said it had requested that Google wait until it released a patch on 13 January."

Dick move. Sorry, I can't think of any other way to describe it. They may have waited until the last minute (or maybe they really did have to rewrite a tonne of code) but that's no excuse or putting users at risk when you can wait two days. Seems more like a marketing tactic than a desire for faster security patches.

[1]https://news.ycombinator.com/item?id=8873704

Re: Microsoft hits out at Google team over bug report

#29

Post by xxyyzz3d »

I think there is something to notice about having a hard fixed timeline for everyone. See from the bug:

https://code.google.com/p/google-security-research/issues/de...

  > Microsoft confirmed that they are on target to provide fixes for these issues
  in February 2015. They asked if this would cause a problem with the 90 day
  deadline.
  
   Microsoft confirmed that they anticipate to provide fixes for these issues in
  January 2015.
So basically Microsoft asked for an extra month, and they said no, which forced them to move quicker, and fix it a month earlier. Without picking any side of the debate, you can still see what effect the non-negotiation of timeline has on getting patches out as soon as possible.

Re: Microsoft hits out at Google team over bug report

#30

Post by Beltiras »

WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

Here's an idea. Knowing Redmond's schedule, could they have notified them but set the disclosure date 2 days ahead? That seems like professional courtesy.
Post reply on HN