Microsoft hits out at Google team over bug report • Hacker News Board

Re: Microsoft hits out at Google team over bug report

#121

Post by [deleted] » Mon, Jan 12, 2015, 4:16 PM UTC

acqq wrote: post #78

dragonwriter wrote: post #60

Earlier quoted context omitted.

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

[deleted]

Re: Microsoft hits out at Google team over bug report

#122

Post by andyrj » Mon, Jan 12, 2015, 4:20 PM UTC

Google expended their resources to find a flaw in a MS product, in which MS was treated as any other vendor. If MS requires the ability to dictate the time alloted to fix their own mistakes, and are unwilling to change their own internal priorities for the sake of their own user base. Then perhaps, they should have found and fixed this prior to Google needing to point it out for them? I am amazed at the blind hatred for Google on this when MS has had a less than spectacular performance with its patches in the last year. Did all the MS fanbois forget about the bsod's just a few months back from MS's own "flawless", as you all seem to believe, patch schedule? (MS14-045 and MS13-036) If this deadline, self imposed by MS, is so greatly beneficial to MS patching why didn't the magic of patch Tuesday prevent those incidents?

Re: Microsoft hits out at Google team over bug report

#123

Post by Mikeb85 » Mon, Jan 12, 2015, 4:22 PM UTC

matwood wrote: post #104

tomiko_nakamura wrote: post #39

Earlier quoted context omitted.

If you start making exceptions, everyone will want one.

When you are the largest provider of the worlds desktop OS, you get exceptions.

You shouldn't. The world's largest OS supplier should have the manpower to fix bugs in a timely fashion.

Re: Microsoft hits out at Google team over bug report

#124

Post by jrockway » Mon, Jan 12, 2015, 4:23 PM UTC

I'm looking forward to the "Scroogled" ads and merchandise highlighting this issue.

Re: Microsoft hits out at Google team over bug report

#125

Post by outside1234 » Mon, Jan 12, 2015, 4:24 PM UTC

cheald wrote: post #116

outside1234 wrote: post #111

"Do no evil" Unless it hurts a competitor and is bad for their customers.

Google's action resulted in a security bugfix which improved the security of Windows, and on faster schedule than Microsoft would have provided otherwise. But sure, let's call it evil.

I get that. I don't get that they didn't let Microsoft fit it into their patch schedule (2 days later).

I don't believe for a second that they would have disclosed this if it was Android and they had a fix that would land within 2 days. No f'ing way.

That's the evil.

Re: Microsoft hits out at Google team over bug report

#126

Post by iolothebard » Mon, Jan 12, 2015, 4:24 PM UTC

shogun21 wrote: post #88

Isn't this all MS's fault for having a security flaw in their system? If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window. Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.

Yeah, MS should develop flawless software like everyone else.

Re: Microsoft hits out at Google team over bug report

#127

Post by dalore » Mon, Jan 12, 2015, 4:34 PM UTC

acqq wrote: post #78

dragonwriter wrote: post #60

Earlier quoted context omitted.

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

Applying a patch to everyone at the same seems risky (not to mention scaling issues). Can't they stagger the patch, so if there is an issue with it then only some users have an issue instead of everyone.

Re: Microsoft hits out at Google team over bug report

#128

Post by fixermark » Mon, Jan 12, 2015, 4:36 PM UTC

Turning the question on its ear a bit:

Even given that Windows 8.1 is a large and complicated machine, what was it about this particular bug that required basically all of Q4 for MS to patch it?

It's one bug.

I have a sinking suspicion that MS simply didn't consider it a priority, even after responsible disclosure to them, which is why it's good that Google's public disclosure policy is a hard-limit 90 days. Too many companies, when given the option to choose their own priority tree over the priority tree enforced by security needs, will choose the former.

Re: Microsoft hits out at Google team over bug report

#129

Post by fixermark » Mon, Jan 12, 2015, 4:37 PM UTC

mark_l_watson wrote: post #97

jenscow wrote: post #58

Earlier quoted context omitted.

or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)

I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.

Of course, the thing about 0-days is that it's hard to say if those users wouldn't have been hurt anyway as the underground community exploited the known-only-to-them, Google, and Microsoft bug.

Re: Microsoft hits out at Google team over bug report

#130

Post by kstrauser » Mon, Jan 12, 2015, 4:42 PM UTC

mark_l_watson wrote: post #97

jenscow wrote: post #58

Earlier quoted context omitted.

or, Google asked for 90 and Microsoft refused. Who's the asshole? (neither, or both)

I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.

That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.