Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

141–150 of 165 posts

Re: Microsoft hits out at Google team over bug report

#141

Post by WorldWideWayne »

delinka wrote: post #93
freehunter wrote: post #86

Earlier quoted context omitted.

Which they're doing with Windows 10. Consumers get them now, business get them on Tuesday. Have you ever deployed patches to a couple thousand machines? It's not something you want to do every night.

When to deploy patches to my thousands of machines is my administration problem, not Microsoft's. Giving me the tools to make these decisions puts more power to protect my company into my hands. Denying patches to me simply to fit a schedule denies me flexibility and, potentially, security.

Microsoft first has to test and deploy the patch to their servers, not yours. At the level they're operating, a schedule seems like an obvious requirement for releasing patches.

Re: Microsoft hits out at Google team over bug report

#142

Post by ethomson »

spydum wrote: post #140
ethomson wrote: post #120

Earlier quoted context omitted.

Despite the long wall of text I just posted, I forgot to mention: some clever person is inevitably going to come at the end of this whole process and say "oh hey guys? I figured out another way to trigger this bug" and you start over from the beginning.

start over? the 90 days is not spent attacking the code.. it's split across testing/packaging/etc. The developers can continue to pour over the code in PARALLEL to the testing to check for similar avenues/triggers, and at any point, push an updated patch, which could move the release date back. Still, how long would it truly take to finish the full cycle? It seems hard to believe it would be months. 90 days is roughl…

Right. Like I said, it sounds crazy that anything would ever take this long. And I'm not saying that it should take 90 days to get a patch out the door. I'm saying that it plausibly take 90 days to get a patch out the door.

For CVE 2014-9390, we had a fix roughly 30 days after we were notified of the vulnerability. In that time, we released patches for the third-party libraries that we use for Git repository management (libgit2 and LibGit2Sharp), we released patches to three versions of Visual Studio and Team Foundation Server, and we worked with the Git for Windows team to ensure that our fixes were nice and compatible. In order to get the VS and TFS patches out the door, we needed all of this time.

(In fact, we discovered additional vulnerabilities on Mac OS very late in the process. Had these problems affected Windows, too, we would have needed to throw our patches away and start over with the build / test validation process.)

And compared to Windows, Visual Studio is not nearly as big or complex, and can turn these changes around faster.

Re: Microsoft hits out at Google team over bug report

#143

Post by WorldWideWayne »

teraflop wrote: post #92
freehunter wrote: post #79

Earlier quoted context omitted.

It doesn't matter if Google publishes it after the patch. It matters if the publish before . If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. Google knew Microsoft had a patch. Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough". Journalists are not direct…

> If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. So? As a general rule, people (and companies) have the right to say things like "I'll do X if you do Y" or "I'll do X unless you do Y". It becomes blackmail under certain circumstances, like where you're threatening to harm someone illegally, or demanding money for coveri…

> It becomes blackmail under certain circumstances, like where you're threatening to harm someone [illegally?]...

As a general rule, if I take action A and action A will result in a higher probability of harm coming to anyone, whether it's illegal or not...I'm a bad guy. Whether you call it blackmail or not, Google is the bad guy here.

> Yup, sounds like competition to me.

Oh good. I hope you can still apply the same logic if your personal bank gets attacked and your money is stolen because of the fact that Google decided to release detailed information to the mafia.

> ...explain why you think this is "anti-competitive."...forbidding a company from trying to demonstrate that its product is more secure...

That's not what's happening here. Google is not demonstrating any product here. The guy who runs Project Zero stated that “People deserve to use the internet without fear that vulnerabilities out there can ruin their privacy with a single website visit,”.

Do you think Google's action here has resulted in more or less of a probability of harm coming to users here?

Re: Microsoft hits out at Google team over bug report

#144

Post by WorldWideWayne »

LukeB_UK wrote: post #33

Everyone is saying that Google should have waited for Microsoft's patch day, but why should Google bend their standard procedure to fit Microsoft? If it really meant that much to Microsoft, they could have released a patch earlier. They knew they had 90 days and decided to ignore it.

Because "They don't have all of the OS code so they have no idea how much other code would have to be rewritten to correct the problem." and "That extra coding takes time to ensure that something else doesn't get broken in the process."

Re: Microsoft hits out at Google team over bug report

#145

Post by WorldWideWayne »

kstrauser wrote: post #130
mark_l_watson wrote: post #97

Earlier quoted context omitted.

I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.

That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.

Sure it is. We know that less people knew the details before Google released the details.

> Historically, it's more likely...

But going on what is actually known, less people knew before Google's actions than after.

EDIT: More accurately: We know that the information was definitely available after Google's action. We don't know that the information was definitely available before.

Re: Microsoft hits out at Google team over bug report

#146

Post by dragonwriter »

outside1234 wrote: post #112
dragonwriter wrote: post #60

Earlier quoted context omitted.

> By now the world really knows about Microsoft's second-tuesday-of-the-month policy for patches. Which is a dumb policy for security patches. When its fixed it should be released. > If Google isn't willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the…

> Which is a dumb policy for security patches. When its fixed it should be released. You are new to IT aren't you?

No, and not even to enterprise IT that the policy supposedly serves.

Failure to blindly adhere to the common view isn't the same as being new.

Re: Microsoft hits out at Google team over bug report

#147

Post by tomiko_nakamura »

matwood wrote: post #104
tomiko_nakamura wrote: post #39

Earlier quoted context omitted.

If you start making exceptions, everyone will want one.

When you are the largest provider of the worlds desktop OS, you get exceptions.

Well, they thought so too. And it turned not to be true. And now they're blaming the others.

Re: Microsoft hits out at Google team over bug report

#148

Post by danielweber »

matwood wrote: post #99
_wmd wrote: post #89

Earlier quoted context omitted.

I wanted to say this, but evidently it was pointless given that seemingly 80% the people on this thread have absolutely no understanding of change management whatsoever, or more importantly the problems you might face when customers have your update infrastructure indirectly linked to national grids and industrial automation. Clearly Microsoft should just release Windows as a repo on GitHub and push fixes to master.

I agree with you and mentioned elsewhere in the thread that patch Tuesday was one of the best moves MS made when they started taking security seriously. Enterprises could now schedule change management around the dates far out into the future which leads to a predictable update schedule downstream. Before, many enterprises rarely patched because the testing involved was a huge pain and it fell outside what they typic…

At a prior company managing firewalls for SMBs that didn't have room for patch management beyond "automatically apply patches", we loved the predictability of Patch Tuesday. Often we would purposefully schedule around it, so if PT did break something, we could point to the schedule and say "nope, we didn't change anything on the box that Tuesday."

Re: Microsoft hits out at Google team over bug report

#149

Post by danielweber »

dalore wrote: post #127
acqq wrote: post #78

Earlier quoted context omitted.

It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them. Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.

Applying a patch to everyone at the same seems risky (not to mention scaling issues). Can't they stagger the patch, so if there is an issue with it then only some users have an issue instead of everyone.

I don't think I'm exaggerating when I say that there is no other company in the world that understands the effects of releasing patches as much as Microsoft does.

Large enterprises already have centralized patch management, so they can decide how fast it gets pushed downstream to their users after MS releases the patch.

Re: Microsoft hits out at Google team over bug report

#150

Post by delinka »

WorldWideWayne wrote: post #141
delinka wrote: post #93

Earlier quoted context omitted.

When to deploy patches to my thousands of machines is my administration problem, not Microsoft's. Giving me the tools to make these decisions puts more power to protect my company into my hands. Denying patches to me simply to fit a schedule denies me flexibility and, potentially, security.

Microsoft first has to test and deploy the patch to their servers, not yours. At the level they're operating, a schedule seems like an obvious requirement for releasing patches.

Of course they have to test internally first. Once the patch is validated, why sit on it for three weeks waiting for that arbitrary date? Put it out as soon as it's ready.
Post reply on HN