Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

131–140 of 165 posts

Re: Microsoft hits out at Google team over bug report

#131

Post by jdjb »

Someone1234 wrote: post #67
tomiko_nakamura wrote: post #24

Earlier quoted context omitted.

So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.

> So, who forces Microsoft to stick to (so called) patch Tuesdays? Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates? > it's Microsoft internal schedule It's their external schedule actually.

Why do all these customers need to be on Microsoft's schedule though? Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed.

If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient.

Re: Microsoft hits out at Google team over bug report

#132

Post by GotAnyMegadeth »

dalore wrote: post #127
acqq wrote: post #78

Earlier quoted context omitted.

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

Applying a patch to everyone at the same seems risky (not to mention scaling issues). Can't they stagger the patch, so if there is an issue with it then only some users have an issue instead of everyone.

If it was an important security patch for a bug that hadn't been publicly disclosed, rolling out to a few machines might be as good as disclosing the bug.

Re: Microsoft hits out at Google team over bug report

#133

Post by Someone1234 »

jdjb wrote: post #131
Someone1234 wrote: post #67

Earlier quoted context omitted.

> So, who forces Microsoft to stick to (so called) patch Tuesdays? Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates? > it's Microsoft internal schedule It's their external schedule actually.

Why do all these customers need to be on Microsoft's schedule though? Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed. If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient.

> Microsoft should release the patches and give each IT team their own ability to assess patches at their own speed.

They already do via WSUS. Companies get to plan this work to start on the second Tuesday of every month because that's the day Microsoft publishes them. Nobody puts a gun to company's heads and forces them to deploy internally.

> If some companies want to wait 2 days then let them make their own choice. It seems like a pretty stupid policy that nothing (except extreme cases) should get patched except when it's convenient.

This seems to be a complaint about a "policy" which doesn't exist and has no relationship to the topic at hand. I don't even really entirely understand the above.

Re: Microsoft hits out at Google team over bug report

#134

Post by sgdread »

You think that 2 days is nothing, but look at this from other perspective: first time MS asks for 2 days (BTW, as others pointed, initially MS said it's not going to be fixed until Feb), next time they ask for a week: last time you gave us 92 days, couldn't you wait for another 3 days? And then it goes, and goes. Then other company asks for a week. If google refuses, there will be unfair treatment and might cause bad press (much worse than this one). So as despite it looked like a dick move, I fully support google's actions. If you compromise on policy once, you're done. So 90 days is a 90 days, no matter what. I think it was a lesson to MS: take this policy with respect and avoid this in future. I'm a software developer and I know how difficult to fix big systems like Windows (burocracy must be crazy there), but the only way to challenge broken processes is to put pressure, otherwise it will never change.

Re: Microsoft hits out at Google team over bug report

#135

Post by forgottenpass »

wampus wrote: post #56
pilif wrote: post #5

This is crazy. By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).…

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesday is a restriction that Microsoft imposes on itself and its users. They had advanced warning and an opportunity to work within the limits of their own policy or roll out an unscheduled update. Even so, this is a clash of two policies and Google needs to reeval…

Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?).

This looks like a solution, but isn't. Perhaps Google's 90 day deadline is already a re-evaluation of a 60-day deadline that was made to accommodate holidays and companies with a once-a-month patch schedule. If Google's deadline was 120 and still hit two days before patch Tuesday, would you say the same thing but for 150?

(N.B. I'm not defending Google, just poking a hole in this particular idea.)

Re: Microsoft hits out at Google team over bug report

#136

Post by jdjb »

jbrooksuk wrote: post #103
orf wrote: post #54

Earlier quoted context omitted.

And Google gave them a 90 day deadline. Doesn't seem right not to extend it by only two days, especially if there was a holiday period in between.

Who is Google to dictate to Microsoft when to release their patches?

They're the ones doing the work of finding these vulnerabilities and being nice enough to report this to Microsoft (and the public) at all.

Re: Microsoft hits out at Google team over bug report

#138

Post by driverdan »

presootto wrote: post #9

Google is just a bunch of hypocrites. Do you remember what happened when they're new ReCaptcha was reverse engineered? Let me remind you: https://news.ycombinator.com/item?id=8728336 Disclaimer: I work for TAGA (The Arrogant Google Assholes)

Not that I think they need to do so but the person who reverse engineered it didn't give Google 90 days notice.

Re: Microsoft hits out at Google team over bug report

#139

Post by dogpa »

Microsoft has been shipping steaming crapola for decades. Their unwieldy and unmaintainable codebase is their own fault. This should not be news to anyone who is unfortunate enough to have to use their awful products.

They sought to dominate the market by means other than having the best talent and shipping the best software. It worked but now they have a problem.

And who can forget this? http://blog.zorinaq.com/?e=74 Developers developers developers.

Any vulns I find will not be dealt with in such a charitable manner. (i.e. you have exactly zero days to fix your shit).

Why on Earth are Google wasting their own resources doing Microsoft's work for them?

Tiny, tiny violins, Microsoft. Tiny, tiny violins.

Re: Microsoft hits out at Google team over bug report

#140

Post by spydum »

ethomson wrote: post #120
ethomson wrote: post #115

Earlier quoted context omitted.

I very much doubt that this was simply "sat on". Not knowing the full breadth of this vulnerability, I can only speculate, but I'm making an educated guess based on several years of working at Microsoft and recently managing a fix for a security vulnerability in several versions of two products. It can sound crazy to you (certainly, it sounded crazy to me at first), but taking 90 days to turn around a fix to a piece…

Despite the long wall of text I just posted, I forgot to mention: some clever person is inevitably going to come at the end of this whole process and say "oh hey guys? I figured out another way to trigger this bug" and you start over from the beginning.

start over? the 90 days is not spent attacking the code.. it's split across testing/packaging/etc. The developers can continue to pour over the code in PARALLEL to the testing to check for similar avenues/triggers, and at any point, push an updated patch, which could move the release date back. Still, how long would it truly take to finish the full cycle? It seems hard to believe it would be months. 90 days is roughly 12+ WEEKS.

Let's take a stab in the dark and say it takes 4 weeks to fully test. That means from day one, MSFT would have 8+ weeks of time for developers to attack the problem (yes blah blah patch tuesday, call it 7 weeks if you wish). I don't know their code, and I don't know how pervasive the problem was, but 7 weeks seems pretty generous when you are handed the problem (and not required to fish it out of "user" complaints).

Post reply on HN