Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

61–70 of 165 posts

Re: Microsoft hits out at Google team over bug report

#61

Post by _wmd »

wampus wrote: post #56
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesday is a restriction that Microsoft imposes on itself and its users. They had advanced warning and an opportunity to work within the limits of their own policy or roll out an unscheduled update. Even so, this is a clash of two policies and Google needs to reeval…

Given that Microsoft had excellent reason to ask for an extra 2 days, I guess the real question is that for a data-driven organization, why Google think 90 days is such a good number in the first place, and why they insisted on sticking to it despite the asinine alternative (forcing tens of thousands of IT departments to coordinate an out of band change for a low severity bug).

Re: Microsoft hits out at Google team over bug report

#62

Post by 300bps »

wampus wrote: post #56
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesday is a restriction that Microsoft imposes on itself and its users. They had advanced warning and an opportunity to work within the limits of their own policy or roll out an unscheduled update. Even so, this is a clash of two policies and Google needs to reeval…

A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process.

Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?

Re: Microsoft hits out at Google team over bug report

#63

Post by orf »

cmdkeen wrote: post #35
spydum wrote: post #10

Earlier quoted context omitted.

unlikely we will know the true internal discussion, but it seems unlikely it realistically took MSFT 92 days to put together a patch. It seems far more likely they sat on the disclosure and did not prioritize it appropriately, after google continued to push for an estimated release date (which they never got). Then when the clock was running out, MSFT asked for extension, and Google being tired of getting put off, sa…

Alternatively, and without your unsubstantiated knocking of Microsoft, perhaps they were needing to conduct serious regression testing. This isn't the "unit tests pass, whack it into production" leagues after all. Plus there's also the small matter of Christmas, and for many countries, significant developer unavailability falling into that period. What's more likely, Microsoft can produce, test and deploy a patch in…

The run tests over every single supported version of Windows, on every platform and with every combination of patches installed. Or so I read in an article by a MS employee who deals with security reports, someone sent in a nonsense 'vulnerability' with some C# POC involving MessageBox.Show and returning from main. It was obviously not in any way a issue, but he still ran it across all versions and patch-levels of windows to be sure. It doesn't say how long this took but I expect it wasn't fast.

Re: Microsoft hits out at Google team over bug report

#64

Post by Someone1234 »

jnbiche wrote: post #47

Look, I'm been really happy with a lot of the stuff Microsoft has been doing recently, particularly in open source. But this is ridiculous. They had plenty of notice that Microsoft's standard 90-day (90 day!) policy applied, and that no exceptions were going to be made. I applaud Google for not bending on their 90-day deadline (assuming they do hold all companies to that, and it appears they do). Maybe this incident…

> There's no telling who else knew about this bug and was actively exploiting it (probably lots of people).

You have no reason to believe it was a "lot of people." In fact we have no reports of people exploiting it in the wild at all, unless you have some information we don't.

edit: Downmod me all you wish, but substantiate your claims. Where is this being exploited in the wild before Google released it?

Re: Microsoft hits out at Google team over bug report

#65

Post by dragonwriter »

gtirloni wrote: post #26
WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

> If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

Its worth noting, as pointed out upthread, that the only reason it was released in January at all was because when Microsoft asked if their planned February release was going to cause a problem with the 90-day deadline, Google informed them the the 90-day deadline for that bug was 11 January and that that's when disclosure would occur. Clearly, the fixed deadline already achieved part of what it was intended to -- encouraging vendors to fix security issues more quickly.

And I'm not sure that there even exists such a thing as a "common sense exception" to that policy, but extending it simply to accommodate a vendor schedule that delays releases of security fixes to predetermined dates isn't such a common sense exception even if any exist. Its simply favoring the bureaucracy of fixed patch schedules over the purpose of the disclosure policy, which is encouraging vendors to more timely release fixes for security bugs.

Re: Microsoft hits out at Google team over bug report

#66

Post by freehunter »

xxyyzz3d wrote: post #29

I think there is something to notice about having a hard fixed timeline for everyone. See from the bug: https://code.google.com/p/google-security-research/issues/de... > Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. Microsoft confirmed that they anticipate to provide fixes for these issues in January 2…

Which sounds like blackmail to me. What did Microsoft have to put aside to move this up in their schedule? Maybe now the release date for Microsoft's new browser slips, giving Google the upper hand? Should corporations force their competitors to move like this? "If you don't drop everything, we're going to release vulnerability details about your product"?

I work in information security and patches are important, I understand. But it worries me that what we're basically seeing here is corporate warfare using security vulnerabilities. What gives any company the right to publish vulnerabilities about their competitors, especially when it has the chance to impact their competitor's performance? Does Pepsi have the right to demand Coke rotate the tires on their trucks within 90 days or they will publish the recipe for Coca Cola?

Re: Microsoft hits out at Google team over bug report

#67

Post by Someone1234 »

tomiko_nakamura wrote: post #24
pilif wrote: post #7

Earlier quoted context omitted.

If Google insists on exactly 90 days without any consideration for patch Tuesdays, this means that, if unlucky, MS will only get 60 days (if they got the announcement right after a patch Tuesday)

So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.

> So, who forces Microsoft to stick to (so called) patch Tuesdays?

Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates?

> it's Microsoft internal schedule

It's their external schedule actually.

Re: Microsoft hits out at Google team over bug report

#68

Post by doodpants »

cmdkeen wrote: post #35
spydum wrote: post #10

Earlier quoted context omitted.

unlikely we will know the true internal discussion, but it seems unlikely it realistically took MSFT 92 days to put together a patch. It seems far more likely they sat on the disclosure and did not prioritize it appropriately, after google continued to push for an estimated release date (which they never got). Then when the clock was running out, MSFT asked for extension, and Google being tired of getting put off, sa…

Alternatively, and without your unsubstantiated knocking of Microsoft, perhaps they were needing to conduct serious regression testing. This isn't the "unit tests pass, whack it into production" leagues after all. Plus there's also the small matter of Christmas, and for many countries, significant developer unavailability falling into that period. What's more likely, Microsoft can produce, test and deploy a patch in…

Arguably, the fact that Google was going to reveal the vulnerability two days before the next patch Tuesday could have been considered sufficient reason to warrant an out of band realease.

Re: Microsoft hits out at Google team over bug report

#69

Post by golemotron »

gtirloni wrote: post #26
WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

Google is all about 'the algorithm' - it's organizational DNA.

Re: Microsoft hits out at Google team over bug report

#70

Post by [deleted] »

dragonwriter wrote: post #60
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

[deleted]
Post reply on HN