[deleted]
Google discloses another Windows security issue after deadline exceeded
11–20 of 152 posts
Re: Google discloses another Windows security issue after deadline exceeded
#12Re: Google discloses another Windows security issue after deadline exceeded
#13Re: Google discloses another Windows security issue after deadline exceeded
#14Earlier quoted context omitted.
This apparently _does_ take that long, but should absolutely not.
Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period. If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time t…
Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/li...
What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed.
https://code.google.com/p/google-security-research/issues/de...
https://code.google.com/p/google-security-research/issues/de...
Re: Google discloses another Windows security issue after deadline exceeded
#15Earlier quoted context omitted.
Might be, but I'm sure if it's important they would allocate resources to getting it fixed ASAP. I doubt the fix for this and testing takes 90 days, or even 45 days.
From the comments in the article Microsoft informed us that a fix was planned for the January patches but has to be pulled due to compatibility issues. Therefore the fix is now expected in the February patches. So, they met the deadline and fixed the vulnerability, but due to compatibility issues had to pull it before being released through Windows Update.
... so they didn't meet the deadline. The deadline is for a released fix, not a theoretical fix that nobody can install in reality. They could, and should, speed up their process. But they won't, unless they get pressure from outside.
Re: Google discloses another Windows security issue after deadline exceeded
#16So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion?
[1] https://code.google.com/p/google-security-research/issues/li...
Re: Google discloses another Windows security issue after deadline exceeded
#17Re: Google discloses another Windows security issue after deadline exceeded
#18Hopefully this inspires change within Microsoft's development processes. Security issues are a big deal. While 90 days is difficult for them (and other companies), I'm sure with some investment on process improvement and or hiring more staff, they can get these fixes out faster. They owe it to their customers to do the right thing.
Re: Google discloses another Windows security issue after deadline exceeded
#19In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support).
[1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...