31–40 of 165 posts
Google is just a bunch of hypocrites. Do you remember what happened when they're new ReCaptcha was reverse engineered? Let me remind you: https://news.ycombinator.com/item?id=8728336 Disclaimer: I work for TAGA (The Arrogant Google Assholes)
Earlier quoted context omitted.
Didn't they give MS 90 days to patch? (That's two or three patch Tuesdays).
And they asked for 92 days and Google decided to publish anyway? While I'm not surprised, it doesn't strike me as the most responsible action.
They knew they had 90 days and decided to ignore it.
Earlier quoted context omitted.
What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?
Does it really matter if it's 90 or 92 day disclosure?
2 days leeway is not uncalled for. Bad form Google.
unlikely we will know the true internal discussion, but it seems unlikely it realistically took MSFT 92 days to put together a patch. It seems far more likely they sat on the disclosure and did not prioritize it appropriately, after google continued to push for an estimated release date (which they never got). Then when the clock was running out, MSFT asked for extension, and Google being tired of getting put off, sa…
Plus there's also the small matter of Christmas, and for many countries, significant developer unavailability falling into that period.
What's more likely, Microsoft can produce, test and deploy a patch in a few days, but chose not to until they had to. Or that they did get a patch ready and tested, but not in time for the patch Tuesday the previous month (so actually got it done in ~62 days) but it didn't warrant an out of band release?
TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…
Earlier quoted context omitted.
Do you know if Microsoft actually talked to Google about waiting a couple more days, or are MS just saying that in their press release?
From the article: >"We asked Google to work with us to protect customers by withholding details until Tuesday, January 13, when we will be releasing a fix," Microsoft's senior director of research Chris Betz said in a blog post.
The issue mentioned in the article [https://code.google.com/p/google-security-research/issues/de...] says that:
> Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline.
So (a) Microsoft is unable to comprehend a simple 90-day policy or (b) do basic math.
This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…
TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…
If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.