Live data from Hacker News

Google discloses another Windows security issue after deadline exceeded

code.google.com

21–30 of 152 posts

Re: Google discloses another Windows security issue after deadline exceeded

#21
post #19

In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...

They fixed those issues with 4.4.

Re: Google discloses another Windows security issue after deadline exceeded

#22
post #19

In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...

Thank the carriers for being jerks for that one. I know on the last time this article came up I took a hard line on them, but upon further reflection, it's not like they can just write a patch and have it out in a week. Heck, it takes months for point releases to go through acceptance testing at the carriers, and probably not insignificant amounts of cash.

At least they're starting to own more of the ecosystem. I wouldn't expect this to be as big of a problem on newer devices.

Re: Google discloses another Windows security issue after deadline exceeded

#23

Hopefully this inspires change within Microsoft's development processes. Security issues are a big deal. While 90 days is difficult for them (and other companies), I'm sure with some investment on process improvement and or hiring more staff, they can get these fixes out faster. They owe it to their customers to do the right thing.

Somehow I foresee Microsoft trying to rush out a security patch to a hugely complicated piece of software so it can be distributed to hundreds of millions of devices running countless hardware configurations just to appease Google ending very poorly for everyone but Google's marketing department.

Re: Google discloses another Windows security issue after deadline exceeded

#24
post #16

So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…

Well HN needs links to be submitted, and then voted up. So I guess to answer your question is that no one at HN cared?

Re: Google discloses another Windows security issue after deadline exceeded

#25
post #16

So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…

[deleted]

Re: Google discloses another Windows security issue after deadline exceeded

#26

Hopefully this inspires change within Microsoft's development processes. Security issues are a big deal. While 90 days is difficult for them (and other companies), I'm sure with some investment on process improvement and or hiring more staff, they can get these fixes out faster. They owe it to their customers to do the right thing.

Given that the holidays occurred during the 90-day period, and that Microsoft was paying attention and made a fix, and that testing found an issue with the fix, I think it would be reasonable for Google to give Microsoft an extension on the deadline.

The statement that "if 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public" is little more than Google claiming the computer made them do it.

Re: Google discloses another Windows security issue after deadline exceeded

#27
post #16

So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…

I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this.

Maybe there's a similar story with OS X, but there doesn't seem to be a public record of it.

Re: Google discloses another Windows security issue after deadline exceeded

#28
post #16

So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…

Well HN needs links to be submitted, and then voted up. So I guess to answer your question is that no one at HN cared?

Yep, the collective "we" got what "we" wanted.

Re: Google discloses another Windows security issue after deadline exceeded

#29
post #19

In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...

I can't fault Google for that. They've released subsequent versions of Android that has fixed the vuln in WebViews.

Also, they took a major step in Android L by removing the WebView from the Android Framework and distributing it via the Play Store, thereby, enabling them to push security updates to all newer devices without the devices themselves having to update to a newer version of Android to get security fixes.

Re: Google discloses another Windows security issue after deadline exceeded

#30
post #19

In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...

Google is not responsible for supporting Android. Android is fully open source, and OEMs are responsible for their devices. AOSP is distributed under Apache 2.0 license https://source.android.com/source/licenses.html which stipulates there's no warranty or support.

Google supports Play Store and related services, but webview on 4.3 and older is not part of that.

Post reply on HN