Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft hits out at Google team over bug report

bbc.co.uk

Post reply on HN
Print view View original

151–160 of 165 posts

Re: Microsoft hits out at Google team over bug report

#151

Post by Robin_Message »

jenscow wrote: post #107
eropple wrote: post #94

Earlier quoted context omitted.

Have you ever managed a nontrivial installation of user-facing desktop systems? 'Cause if not, declaring the policy of a predictable, telegraphed-well-in-advance day on which security patches will drop "peculiar" kind of just reveals where your head's at.

The rate at which security vulnerabilities are reported/abused isn't predictable. Please don't sit on a fix until the time is more "convenient", give it to me now and let me be the judge on how important this security patch is to me.

Because the patch can easily be reversed into the exploit, it has to be convenient for everyone in the herd to apply it at the same time unfortunately.

Re: Microsoft hits out at Google team over bug report

#152

Post by danielweber »

doe88 wrote: post #91

If I were MS I wouldn't complain on this issue and instead I would just take the bait and put an internal team to find out bugs exclusively in Google products like for instance Android [1] and declare an arbitrary short disclosure policy [2] and then release these bugs when time is up. [1] https://news.ycombinator.com/item?id=8874339 [2] https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pl...

Two wrongs don't make a right. This is an arms race that will not benefit users.

Re: Microsoft hits out at Google team over bug report

#153

Post by tomiko_nakamura »

Someone1234 wrote: post #67
tomiko_nakamura wrote: post #24

Earlier quoted context omitted.

So, who forces Microsoft to stick to (so called) patch Tuesdays? No one, actually - it's Microsoft internal schedule, and clearly there are cases when it's absolutely unreasonable - e.g. when there's a 0day in the wild. So there has to be a way to fast track a fix - if there's not, there's something seriously wrong IMNSHO. Apparently, they thought Google won't stick to the 90-day limit.

> So, who forces Microsoft to stick to (so called) patch Tuesdays? Their tens of millions of customers who plan internal deployment, overtime, and other things around those specific dates? > it's Microsoft internal schedule It's their external schedule actually.

I don't really see how that matters. This only shows how utterly broken the concept of "patch Tuesdays" is ...

If you plan your internal deployment updates based on the belief that the schedule will never change, then I'm really sorry for you and your users. In real world, not all issues are reported in advance - some are observed in the wild, and in that case you have to fast-track the fix. If you have no way to do that (e.g. because the vendor only releases fixes on Tuesdays once per month, or because you decided to choose such schedule on your own), then good luck. That might have been appropriate in 1995, not in 2015.

There are many projects and/or companies publishing fixes continuously, and leaving it up to the users when/how to apply them in production. That's essentially what all the linux distributions (RH, Suse, ...) and smaller projects do.

Re: Microsoft hits out at Google team over bug report

#154

Post by danielweber »

kstrauser wrote: post #130
mark_l_watson wrote: post #97

Earlier quoted context omitted.

I think it is safe to say that it is likely that many end users were hurt by Google not waiting the extra two days.

That's not safe to say. You're presuming that Microsoft and Google are the only two parties who knew about the exploit. Historically, it's more likely that the vulnerability was already known among cracking circles, and Google just announced something that was already in the wild.

> Historically, it's more likely that the vulnerability was already known among cracking circles,

Why do you say this?

It implies a world where software is almost perfectly secure, and there are only a few bugs to fix, and then it's perfectly secure, and we are all happy.

In reality, there are effectively an infinite number of bugs out there, many with security holes. Finding one and going through the motions to fix, patch, test, and release still leaves you software with plenty of open holes.

If you magically theorize "the bad guys know about all the holes already," then they are still going to exploit all the other holes in the system, because they magically know about them, too.

Re: Microsoft hits out at Google team over bug report

#156

Post by cheald »

outside1234 wrote: post #125
cheald wrote: post #116

Earlier quoted context omitted.

Google's action resulted in a security bugfix which improved the security of Windows, and on faster schedule than Microsoft would have provided otherwise. But sure, let's call it evil.

I get that. I don't get that they didn't let Microsoft fit it into their patch schedule (2 days later). I don't believe for a second that they would have disclosed this if it was Android and they had a fix that would land within 2 days. No f'ing way. That's the evil.

Microsoft's patch schedule was going to be 32 days later. The hard stance produced a positive outcome here; the patch was available a full month earlier than it otherwise would have been. There is a lot of history between security researchers and big vendors, where the big vendor just delays and delays and delays while the bug is running around out in the wild.

I really do hear what you're saying, and while I'm sympathetic to it, I think that it's much more likely that the Project Zero team adopted the 90-day policy specifically because of years and years of vendors playing push-the-deadline. If there was an industry history of vendors acting promptly in good faith, this wouldn't even be a thing, but the politics behind bug reporting and disclosure are really pretty mature at this point, and I really do think it's naive to just chalk it up to "Google wants to embarrass its competition and is playing dirty to do it".

Re: Microsoft hits out at Google team over bug report

#159

Post by dwild »

freehunter wrote: post #66
xxyyzz3d wrote: post #29

I think there is something to notice about having a hard fixed timeline for everyone. See from the bug: https://code.google.com/p/google-security-research/issues/de... > Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. Microsoft confirmed that they anticipate to provide fixes for these issues in January 2…

Which sounds like blackmail to me. What did Microsoft have to put aside to move this up in their schedule? Maybe now the release date for Microsoft's new browser slips, giving Google the upper hand? Should corporations force their competitors to move like this? "If you don't drop everything, we're going to release vulnerability details about your product"? I work in information security and patches are important, I u…

You act like security vulnerabilities aren't important. If Google found that security vulnerability, how much black hat already found it or are going to find it in the next 90 days? Sadly we can't know, that's why we need to set a schedule, there's no soon enough.

Re: Microsoft hits out at Google team over bug report

#160

Post by dwild »

jnbiche wrote: post #47

Look, I'm been really happy with a lot of the stuff Microsoft has been doing recently, particularly in open source. But this is ridiculous. They had plenty of notice that Microsoft's standard 90-day (90 day!) policy applied, and that no exceptions were going to be made. I applaud Google for not bending on their 90-day deadline (assuming they do hold all companies to that, and it appears they do). Maybe this incident…

Personally I feel like they should allow stuff like 2 days more, but they would need to be really strict about it.

Reading the comments on the ticket however, I really feel like Microsoft was in the wrong here. They asked 4 days ago to push it for a whole month and then now they are fine for their January release. I really feel like they start to feel the pressure of the 90 days so being strict about it is a good choice from Google.

Post reply on HN