Microsoft hits out at Google team over bug report • Hacker News Board

Re: Microsoft hits out at Google team over bug report

#161

Post by rbanffy » Tue, Jan 13, 2015, 12:58 PM UTC

acqq wrote: post #78

dragonwriter wrote: post #60

Earlier quoted context omitted.

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

There is a thing here.

You apply a dozen different fixes and test. Something breaks badly. You now have a dozen different root causes to check when, if you applied one at a time and tested (or applied one at a time and let your users test it, which is more commonplace than it should - automated testing tools exist for a reason) you'd know what broke.

I'd prefer to have fixes available for rollout as soon as possible and to decide whether I deploy them or not based on my tests. Automatic mandatory deployment could be on a fixed schedule, for those who can't test or don't care much about it.

Re: Microsoft hits out at Google team over bug report

#162

Post by jnbiche » Tue, Jan 13, 2015, 1:29 PM UTC

Someone1234 wrote: post #64

jnbiche wrote: post #47

Look, I'm been really happy with a lot of the stuff Microsoft has been doing recently, particularly in open source. But this is ridiculous. They had plenty of notice that Microsoft's standard 90-day (90 day!) policy applied, and that no exceptions were going to be made. I applaud Google for not bending on their 90-day deadline (assuming they do hold all companies to that, and it appears they do). Maybe this incident…

> There's no telling who else knew about this bug and was actively exploiting it (probably lots of people). You have no reason to believe it was a "lot of people." In fact we have no reports of people exploiting it in the wild at all, unless you have some information we don't. edit: Downmod me all you wish, but substantiate your claims. Where is this being exploited in the wild before Google released it?

My exact phrase was "there's no telling", which is meant to indicate uncertainty. We don't know who or how this was exploited (if at all).

But I agree with you that I shouldn't have written "probably lots of people". I have no basis for that assertion. I retract that sentence (but not the rest).

By the way, I didn't downvote you. In fact, I almost certainly would have even upvoted your comment if you hadn't made the edit complaining about the downvote (against HN guidelines) and accusing me of downvoting you (false accusation).

As a general rule, you should never assume that the person you're disagreeing with was the one who downvoted. Many of us on HN only downvote people who are making low-information comments (which your comment was not, indeed it made me reconsider an assertion) or comments made in bad faith (yours was not, as far as I know).

Re: Microsoft hits out at Google team over bug report

#163

Post by WorldWideWayne » Tue, Jan 13, 2015, 3:28 PM UTC

delinka wrote: post #150

WorldWideWayne wrote: post #141

Earlier quoted context omitted.

Microsoft first has to test and deploy the patch to their servers, not yours. At the level they're operating, a schedule seems like an obvious requirement for releasing patches.

Of course they have to test internally first. Once the patch is validated, why sit on it for three weeks waiting for that arbitrary date? Put it out as soon as it's ready.

Could you provide a citation for Microsoft sitting on it for three weeks?

Re: Microsoft hits out at Google team over bug report

#164

Post by fixermark » Tue, Jan 13, 2015, 5:18 PM UTC

freehunter wrote: post #59

upofadown wrote: post #38

Earlier quoted context omitted.

Microsoft was actually asking for 92 days to fix the bug, not 2 days...

Google gave them 90 days (by Google's policy). Microsoft had the fix, but asked for another 2 days in order to fit within their patching cycle. Google decided to take action outside of Microsoft's (well established) patch cycle. Then again what does Google care, they don't use or support anything Microsoft, so it doesn't affect them.

Chrome runs on Windows.

As does Google Earth, Google Drive, the android development toolchain, and a handful of other desktop clients that I'm not going to bother to look up right now.

Re: Microsoft hits out at Google team over bug report

#165

Post by wglb » Wed, Jan 14, 2015, 6:47 AM UTC

_wmd wrote: post #118

jenscow wrote: post #98

Earlier quoted context omitted.

Why can't we just have the choice to apply as soon as it's ready? If you don't want to apply the patches as soon as they're released, then you'd be more than welcome to put them on hold for 4 weeks yourself when it's more convenient.

Basically because bindiff ( http://www.zynamics.com/bindiff.html ). The moment an updated binary is available, the clock starts ticking towards a vulnerability being reverse engineered from the update. A few years back, there was a huge amount of research in the infosec community whose goal was to automate extraction of these vulnerabilities (yes really - a robot automatically producing 0-day given an updated binary)…

This entire discussion presumes that this bindiff method of discovering the bugs in Windows is the only method available to attackers.

What are the chances that attackers or other agencies already know of these vulnerabilities and are exploiting them?

Microsoft's delays extend the time that the silent attackers have.