Dick move by Google.
Google discloses another Windows security issue after deadline exceeded
61–70 of 152 posts
Re: Google discloses another Windows security issue after deadline exceeded
#62As they should do, Microsoft is notoriously bad at security patching and have had more than enough time to issue a suitable fix. It won't be until we start doing this will all (closed sourced) vendors that'll we'll actually see improvements - otherwise what incentives for these company's are there? Making themselves look good is their primary objective, right next to sales.
Re: Google discloses another Windows security issue after deadline exceeded
#63In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...
They fixed those issues with 4.4.
and then you have tons of device who cannot upgrade to 4.4
Re: Google discloses another Windows security issue after deadline exceeded
#64[deleted]
Re: Google discloses another Windows security issue after deadline exceeded
#65Earlier quoted context omitted.
Google is not responsible for supporting Android. Android is fully open source, and OEMs are responsible for their devices. AOSP is distributed under Apache 2.0 license https://source.android.com/source/licenses.html which stipulates there's no warranty or support. Google supports Play Store and related services, but webview on 4.3 and older is not part of that.
Android is "fully open source" except that Google writes 99.999% of the code in secret. Rarely they will accept a pull request but there is zero transparency into that process.
When I go to their public code review app [0], it looks pretty active. The last 100 changes listed there were modified in the last 24 hours!
Which parts are they coding in secret? (Honestly, I don't know, please help me understand)
[0]: https://android-review.googlesource.com/#/q/status:open
Re: Google discloses another Windows security issue after deadline exceeded
#66Earlier quoted context omitted.
I really dislike your description because while it is technically true it heavily implies that they decided on dates on a per-bug case, when they decided on a flat 90 days.
Then again, 90 days contains 2.5 of their fix cycles. If the vulnerability really is serious, and they can't fix it in that time line, they should exit the business.
As noted in the bug, it is not just writing a fix but writing one that works against all supported configurations that is the cause of a delay.
Re: Google discloses another Windows security issue after deadline exceeded
#67In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...
Thank the carriers for being jerks for that one. I know on the last time this article came up I took a hard line on them, but upon further reflection, it's not like they can just write a patch and have it out in a week. Heck, it takes months for point releases to go through acceptance testing at the carriers, and probably not insignificant amounts of cash. At least they're starting to own more of the ecosystem. I wou…
Carriers not rolling out updates a) doesn't waive Google's responsibility to roll out patches to their largest OS cohort and b) is really all Google's fault because they let the carriers get away with it and have never reigned them in even after years of incompetence on the carriers' part.
It's not an excuse.
Re: Google discloses another Windows security issue after deadline exceeded
#68Re: Google discloses another Windows security issue after deadline exceeded
#69In another news, google stop fixing security bugs which cover 60% of the current android users (4.3 or older). Not saying microsoft is right, but they just dropped windows xp support last year (that is >10 years of support). [1] http://arstechnica.com/security/2015/01/google-wont-fix-bug-...
Thank the carriers for being jerks for that one. I know on the last time this article came up I took a hard line on them, but upon further reflection, it's not like they can just write a patch and have it out in a week. Heck, it takes months for point releases to go through acceptance testing at the carriers, and probably not insignificant amounts of cash. At least they're starting to own more of the ecosystem. I wou…
Seriously, if you depend on heavily unreliable third parties to deploy critical patches to your product, your release mechanism is broken.
Re: Google discloses another Windows security issue after deadline exceeded
#70So there are 3 issues [1] against OS X, released a while ago, and one against Microsoft. Why the HN focus on the Windows bugs? At least Microsoft is communicating with Google, and have patches planned, just not on the exact timeline of the arbitrary 90 day deadline. Is there something about the OS X ones that doesn't warrant the same exposure/discussion? [1] https://code.google.com/p/google-security-research/issues/l…
I think the issue is not the bug count, but that Microsoft tells Google "we will release a fix on day X," and Google says "X is past an arbitrary day we chose, so sad" and discloses a zero-day. Some people think it's an irresponsible PR stunt by Google, others that Microsoft would just put off fixes forever if Google didn't do this. Maybe there's a similar story with OS X, but there doesn't seem to be a public record…
Think what you want, but IMO 90 days (even rounded to the nearest patch Tuesday) is plenty of time to fix the critical security issue. Clearly Microsoft is acting weird here.