Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

81–90 of 165 posts

Re: Microsoft hits out at Google team over bug report

#81

Post by michaelt »

smackfu wrote: post #23
WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.

The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness.

You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...

Re: Microsoft hits out at Google team over bug report

#82

Post by itg »

santacluster wrote: post #72
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

The "second-tuesday-of-the-month" policy is a completely arbitrary MS-only policy. If Google (or any other group that discovers security issues) has to take into account every policy of every software producer it becomes utterly impossible to have any disclosure policy. If MS wants to handicap themselves, that's their problem. The rest of the world doesn't have to bend to their will, those days are over. Yes, this is…

The "90 days" policy is a completely arbitrary Google-only policy. There is no reason they couldn't wait a bit longer before disclosing.

Re: Microsoft hits out at Google team over bug report

#83

Post by freehunter »

Corrado wrote: post #73
iN7h33nD wrote: post #48

Earlier quoted context omitted.

I agree with this completely. Even if Google didn't know about patch days they should have allowed them two more days to release the patch since they asked for it. I would even say they could have given them another week window if they needed it. Releasing an exploit into the wild when you know a patch is coming is a really awe-full thing to do. If the tables were turned I wonder what Microsoft would have done here.

And the next company that comes along will ask for 3 days, and then 5 days, etc. Pretty soon we're back to serious bugs not getting fixed until the vendor feels like it. The power of a set timeline is the fact that its not up to the vendor when things happen. They have proven time and again that they won't fix things until they are forced to; this forces them. It's just like being late for work. "But I was only 5 min…

The last place I worked that cared if I was 5 minutes late to work was Wal-Mart when I was a teenager.

Re: Microsoft hits out at Google team over bug report

#84

Post by acqq »

Corrado wrote: post #73
iN7h33nD wrote: post #48

Earlier quoted context omitted.

I agree with this completely. Even if Google didn't know about patch days they should have allowed them two more days to release the patch since they asked for it. I would even say they could have given them another week window if they needed it. Releasing an exploit into the wild when you know a patch is coming is a really awe-full thing to do. If the tables were turned I wonder what Microsoft would have done here.

And the next company that comes along will ask for 3 days, and then 5 days, etc. Pretty soon we're back to serious bugs not getting fixed until the vendor feels like it. The power of a set timeline is the fact that its not up to the vendor when things happen. They have proven time and again that they won't fix things until they are forced to; this forces them. It's just like being late for work. "But I was only 5 min…

It's a kind of thinking of the bureaucrat and not of an engineer. I'm the later, and in my areas of work the tolerance of 10% is the default, the tolerance of 20% or 25% is also natural, and only something more than that is something that is even worth the words.

As far as I know, some other engineering areas have even the safety factor of 2 or 3. That means, you expect the stress x, but your process has to sustain even 3 x.

Edit: Zero tolerances are never a good idea.

http://civilrightsproject.ucla.edu/research/k-12-education/s...

Re: Microsoft hits out at Google team over bug report

#86

Post by freehunter »

delinka wrote: post #76
freehunter wrote: post #66

Earlier quoted context omitted.

Which sounds like blackmail to me. What did Microsoft have to put aside to move this up in their schedule? Maybe now the release date for Microsoft's new browser slips, giving Google the upper hand? Should corporations force their competitors to move like this? "If you don't drop everything, we're going to release vulnerability details about your product"? I work in information security and patches are important, I u…

In what world does the recipe for Coca Cola in any way influence the maintenance of a fleet of trucks? Google's policy is responsible disclosure. Wavering on the well-known deadline would become a political headache. If you give a mouse a cookie... Two days becomes a week; a week becomes half of a month; half a month becomes a full month. Perhaps if Google is feeling generous, they could not disclose a vulnerability…

Which they're doing with Windows 10. Consumers get them now, business get them on Tuesday. Have you ever deployed patches to a couple thousand machines? It's not something you want to do every night.

Re: Microsoft hits out at Google team over bug report

#87

Post by Beltiras »

tomiko_nakamura wrote: post #32
majc2 wrote: post #8

Earlier quoted context omitted.

And they asked for 92 days and Google decided to publish anyway? While I'm not surprised, it doesn't strike me as the most responsible action.

If you define a limit for disclosure, and then not stick to it, why to define a limit in the first place? 90 days is more than enough - if MS has a lot of internal overhead, you should probably complain to them, not to google.

If contacted by the other party and they give a good reason (in this case: "We have a fix, it's slated for release in line with other things on tuesday"), I think a responsible security researcher should give that time. If patch day rolls around and no production, go ahead and shame. This is not a case of overhead, MS world functions a bit differently from package management in Linux.

Re: Microsoft hits out at Google team over bug report

#88

Post by shogun21 »

Isn't this all MS's fault for having a security flaw in their system?

If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window.

Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.

Re: Microsoft hits out at Google team over bug report

#89

Post by _wmd »

acqq wrote: post #78
dragonwriter wrote: post #60

Earlier quoted context omitted.

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

I wanted to say this, but evidently it was pointless given that seemingly 80% the people on this thread have absolutely no understanding of change management whatsoever, or more importantly the problems you might face when customers have your update infrastructure indirectly linked to national grids and industrial automation. Clearly Microsoft should just release Windows as a repo on GitHub and push fixes to master.

Re: Microsoft hits out at Google team over bug report

#90

Post by RubyPinch »

LukeB_UK wrote: post #33

Everyone is saying that Google should have waited for Microsoft's patch day, but why should Google bend their standard procedure to fit Microsoft? If it really meant that much to Microsoft, they could have released a patch earlier. They knew they had 90 days and decided to ignore it.

"but why should Google bend their standard procedure to fit Microsoft?" well, there are quite a few users affected.
Post reply on HN