Earlier quoted context omitted.
Other companies do not develop enterprise operating systems.
You mean like Redhat?
RedHat runs on no where near as many devices as Windows does.
Google discloses another Windows security issue after deadline exceeded
31–40 of 152 posts
Re: Google discloses another Windows security issue after deadline exceeded
#32In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...
Google is not responsible for supporting Android. Android is fully open source, and OEMs are responsible for their devices. AOSP is distributed under Apache 2.0 license https://source.android.com/source/licenses.html which stipulates there's no warranty or support. Google supports Play Store and related services, but webview on 4.3 and older is not part of that.
Android is "fully open source" except that Google writes 99.999% of the code in secret. Rarely they will accept a pull request but there is zero transparency into that process.
Re: Google discloses another Windows security issue after deadline exceeded
#33Earlier quoted context omitted.
Other companies do not develop enterprise operating systems.
How is that a reasonable excuse? If they have so much money their operating system should be fixed faster, not slower, than other operating systems.
More money (or resources) = faster solutions is a pretty common fallacy.
Often the size, scope and wealth of resources induces an increasingly slower response to such things.
Re: Google discloses another Windows security issue after deadline exceeded
#34So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…
Because a Windows zero-day is a major risk to our economic system as our business and governments infrastructures run on MS products for the most part. OSX just doesn't have that level of install base and for the most part its installed on consumer/residential equipment. Heck, most OSX shops I've been part of have bog standard Windows AD on the back-end. Windows, good or bad, is everywhere that matters.
Google seems to think Windows is a poorly written php app where you can just change a line and walk away. Windows testing has to be top notch and handle a huge about of 3rd party software, libraries, and drivers. The 90 day deadline really speaks to how web devs think and not how application engineers with massive install bases on a variety of equipment and running a variety of software think.
It does piss me off to be honest. MS isn't saying no to the updates its just saying, "We're doing them in 100 days, not 90 as out of band patches are really bad for the ecosystem and we need more time to certify our changes." Google is saying, "Fuck you. Buy an android tablet, microserfs."
Imagine if Google found the Kaminsky DNS bug. The internet would have melted on day 91 when google told everyone, "Sorry, too bad." I think this kind of "fuck you" disclosure should only be for attacks that have been demonstrated to be in the wild. Now they will be in various crimepaks, botnets, and trojan droppers within hours.
Re: Google discloses another Windows security issue after deadline exceeded
#35Earlier quoted context omitted.
From the comments in the article Microsoft informed us that a fix was planned for the January patches but has to be pulled due to compatibility issues. Therefore the fix is now expected in the February patches. So, they met the deadline and fixed the vulnerability, but due to compatibility issues had to pull it before being released through Windows Update.
... so they didn't meet the deadline. The deadline is for a released fix, not a theoretical fix that nobody can install in reality. They could, and should, speed up their process. But they won't, unless they get pressure from outside.
...yea it's easy to say when most people here should know how hard it is to ship any complicated system on multiple platforms. Actually, just making an app work for all major versions of Android could be a nightmare. And...what do you mean "they won't speed up their process"? Microsoft has released zero-day security bug fixes less than 90 days so many times before.
Re: Google discloses another Windows security issue after deadline exceeded
#36So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…
I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this. Maybe there's a similar story with OS X, but there doesn't seem to be a public record…
I really dislike your description because while it is technically true it heavily implies that they decided on dates on a per-bug case, when they decided on a flat 90 days.
Re: Google discloses another Windows security issue after deadline exceeded
#37Earlier quoted context omitted.
Google is not responsible for supporting Android. Android is fully open source, and OEMs are responsible for their devices. AOSP is distributed under Apache 2.0 license https://source.android.com/source/licenses.html which stipulates there's no warranty or support. Google supports Play Store and related services, but webview on 4.3 and older is not part of that.
Android is "fully open source" except that Google writes 99.999% of the code in secret. Rarely they will accept a pull request but there is zero transparency into that process.
That sucks but it's not relevant to google having released a new version and carriers ignoring it.
Re: Google discloses another Windows security issue after deadline exceeded
#38Earlier quoted context omitted.
... so they didn't meet the deadline. The deadline is for a released fix, not a theoretical fix that nobody can install in reality. They could, and should, speed up their process. But they won't, unless they get pressure from outside.
...yea it's easy to say when most people here should know how hard it is to ship any complicated system on multiple platforms. Actually, just making an app work for all major versions of Android could be a nightmare. And...what do you mean "they won't speed up their process"? Microsoft has released zero-day security bug fixes less than 90 days so many times before.
I didn't say it was easy. I said Microsoft could do it, and that's true. Microsoft can do hard things, if it's a priority for them. Apparently they've judged that the damage isn't worth prioritizing these fixes higher.
Re: Google discloses another Windows security issue after deadline exceeded
#39Earlier quoted context omitted.
... so they didn't meet the deadline. The deadline is for a released fix, not a theoretical fix that nobody can install in reality. They could, and should, speed up their process. But they won't, unless they get pressure from outside.
...yea it's easy to say when most people here should know how hard it is to ship any complicated system on multiple platforms. Actually, just making an app work for all major versions of Android could be a nightmare. And...what do you mean "they won't speed up their process"? Microsoft has released zero-day security bug fixes less than 90 days so many times before.
'making a program work' can easily be half your development time, or even more if you don't put on a lot of polish.
But this is bugfixing, not creating new programs. It shouldn't take this long.
Re: Google discloses another Windows security issue after deadline exceeded
#40So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…
I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this. Maybe there's a similar story with OS X, but there doesn't seem to be a public record…
> [...] and discloses a zero-day.
90-day, you mean. It's only zero-day if they had zero days to come up with a solution. That's what "zero-day" means.