Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

101–110 of 165 posts

Re: Microsoft hits out at Google team over bug report

#101

Post by acqq »

jenscow wrote: post #98
acqq wrote: post #78

Earlier quoted context omitted.

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

Why can't we just have the choice to apply as soon as it's ready? If you don't want to apply the patches as soon as they're released, then you'd be more than welcome to put them on hold for 4 weeks yourself when it's more convenient.

This time, the "ready" will be the following Tuesday. Google didn't respect this, effectively providing the 0-day to the world.

There are bad guys looking for 0-days out there. If they learn about the vulnerability from the patch, at least the world has the patch before the bad guys do. Now it's the opposite.

Edit: See _wmd's explanation about the technical details of all this in the same level of the answers.

Re: Microsoft hits out at Google team over bug report

#102

Post by divegeek »

sixothree wrote: post #95
WestCoastJustin wrote: post #12

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January. Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples…

I wonder how many Android devices out there are missing security updates.

None that Google can update.

Re: Microsoft hits out at Google team over bug report

#103

Post by jbrooksuk »

orf wrote: post #54
upofadown wrote: post #38

Earlier quoted context omitted.

Microsoft was actually asking for 92 days to fix the bug, not 2 days...

And Google gave them a 90 day deadline. Doesn't seem right not to extend it by only two days, especially if there was a holiday period in between.

Who is Google to dictate to Microsoft when to release their patches?

Re: Microsoft hits out at Google team over bug report

#104

Post by matwood »

tomiko_nakamura wrote: post #39
gtirloni wrote: post #26

Earlier quoted context omitted.

If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

If you start making exceptions, everyone will want one.

When you are the largest provider of the worlds desktop OS, you get exceptions.

Re: Microsoft hits out at Google team over bug report

#105

Post by acqq »

pzxc wrote: post #100
acqq wrote: post #78

Earlier quoted context omitted.

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

If you're in a situation where you test the effects of patches before applying them, then if Microsoft releases the security patch early, YOU have the option to wait and apply it on the regular patch day along with any other patches in the normal schedule. Releasing the patch late (i.e., on patch day) makes that choice for everyone.

With the patch ready before the vulnerability release, there's no 0-day available to the all nefarious guys in the world. Now thanks to Google, there's one. (Edit: See _wmd's explanation about the technical details of this).

It's not that just the big companies are affected now: all users are.

Re: Microsoft hits out at Google team over bug report

#106

Post by harsh1618 »

dragonwriter wrote: post #60
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

I wonder how people would have responded had the disclosure come from an independent security researcher instead of Google, knowing fully well that a patch is to be rolled out in 2 days.

Re: Microsoft hits out at Google team over bug report

#107

Post by jenscow »

eropple wrote: post #94
santacluster wrote: post #72

Earlier quoted context omitted.

The "second-tuesday-of-the-month" policy is a completely arbitrary MS-only policy. If Google (or any other group that discovers security issues) has to take into account every policy of every software producer it becomes utterly impossible to have any disclosure policy. If MS wants to handicap themselves, that's their problem. The rest of the world doesn't have to bend to their will, those days are over. Yes, this is…

Have you ever managed a nontrivial installation of user-facing desktop systems? 'Cause if not, declaring the policy of a predictable, telegraphed-well-in-advance day on which security patches will drop "peculiar" kind of just reveals where your head's at.

The rate at which security vulnerabilities are reported/abused isn't predictable.

Please don't sit on a fix until the time is more "convenient", give it to me now and let me be the judge on how important this security patch is to me.

Re: Microsoft hits out at Google team over bug report

#109

Post by [deleted] »

cmdkeen wrote: post #21
timonovici wrote: post #15

Earlier quoted context omitted.

What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?

What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits. Microsoft do issue out of band updates but they are very rare and for very serious issues. It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled rele…

[deleted]

Re: Microsoft hits out at Google team over bug report

#110

Post by [deleted] »

Someone1234 wrote: post #67
tomiko_nakamura wrote: post #24

Earlier quoted context omitted.

So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.

> So, who forces Microsoft to stick to (so called) patch Tuesdays? Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates? > it's Microsoft internal schedule It's their external schedule actually.

[deleted]
Post reply on HN