Project Zero – Policy and Disclosure: 2025 Edition
googleprojectzero.blogspot.com
Project Zero – Policy and Disclosure: 2025 Edition
1–10 of 41 posts
Re: Project Zero – Policy and Disclosure: 2025 Edition
#2Related links:
- Vulnerability Disclosure FAQ ( https://googleprojectzero.blogspot.com/p/vulnerability-discl... )
- Reporting Transparency ( https://googleprojectzero.blogspot.com/p/reporting-transpare... )
Re: Project Zero – Policy and Disclosure: 2025 Edition
#3If Google is adopting this, maybe rachelbythebay's vagueposting was ahead of the curve?
I jest; the vagueposting led to uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers: https://news.ycombinator.com/item?id=43477057
I hope Google's experiment doesn't turn out the same.
Re: Project Zero – Policy and Disclosure: 2025 Edition
#4If Google is adopting this, maybe rachelbythebay's vagueposting was ahead of the curve? I jest; the vagueposting led to uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers: https://news.ycombinator.com/item?id=43477057 I hope Google's experiment doesn't turn out the same.
Speaking of, whatever came out of that? I don't see any related updates on that blog.
Re: Project Zero – Policy and Disclosure: 2025 Edition
#5If Google is adopting this, maybe rachelbythebay's vagueposting was ahead of the curve? I jest; the vagueposting led to uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers: https://news.ycombinator.com/item?id=43477057 I hope Google's experiment doesn't turn out the same.
> uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers
To be fair, it seems like the only way of avoiding something like that is never saying anything publicly. The crowds of the internet eagerly jump into any drama, vague or not, and balloon it regardless.
Re: Project Zero – Policy and Disclosure: 2025 Edition
#6If Google is adopting this, maybe rachelbythebay's vagueposting was ahead of the curve? I jest; the vagueposting led to uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers: https://news.ycombinator.com/item?id=43477057 I hope Google's experiment doesn't turn out the same.
Speaking of, whatever came out of that? I don't see any related updates on that blog.
This was published the day after, with the title "Problems with the heap" but the URL makes the context clear: https://rachelbythebay.com/w/2025/03/26/atop/
Re: Project Zero – Policy and Disclosure: 2025 Edition
#7This seems like a good move. I do hope that slow moving consumers of the software in question can start anticipating an upcoming release and construct remediation plans instead of doing that after the release.
Re: Project Zero – Policy and Disclosure: 2025 Edition
#8If Google is adopting this, maybe rachelbythebay's vagueposting was ahead of the curve? I jest; the vagueposting led to uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers: https://news.ycombinator.com/item?id=43477057 I hope Google's experiment doesn't turn out the same.
> I jest; the vagueposting led to [...]
Resurrecting a 4 month old issue that evaporated in a day or two seems like poor form to me.
Also I believe most of the responsibility for the negative behavior should be assigned to those actually engaging in it, not the initial post. I understand others reasonably disagree (notably about the accusation and harrassment).
Tbh, it sounds like you might have been personally affected? At any rate, I certainly don't condone a mob mentality.
Re: Project Zero – Policy and Disclosure: 2025 Edition
#9If Google is adopting this, maybe rachelbythebay's vagueposting was ahead of the curve? I jest; the vagueposting led to uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers: https://news.ycombinator.com/item?id=43477057 I hope Google's experiment doesn't turn out the same.
> uninformed speculation, panic, reddit levels of baseless accusation, and harassment of the developers To be fair, it seems like the only way of avoiding something like that is never saying anything publicly. The crowds of the internet eagerly jump into any drama, vague or not, and balloon it regardless.
I remember when heartbleed was the big thing. There were many people digging into the person who committed the bug. Looking for where they lived, worked, and traveled. Many people were so desperate to find something to prove he was a spy.
If you google his name, 80% of the results are articles about how he denying doing that on purpose.
Re: Project Zero – Policy and Disclosure: 2025 Edition
#10Not sure what is the measurable metric here, and what will be considered a success in this trial period.
Propagating the fix downstream depends on the release cycles of all downward vendors. Giving them a heads up will help planning, but I doubt it will significantly impact the patching timeline.
It is highly more likely that companies will get stressed that the public knows they have a vulnerability, while they are still working to fix it. The pressure from these companies will probably shut this policy change down.
Also, will this policy apply also to Google's own products?