TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Microsoft hits out at Google team over bug report

97 点作者 oinkgrr超过 10 年前

28 条评论

pilif超过 10 年前
This is crazy. By now the world really knows about Microsoft&#x27;s second-tuesday-of-the-month policy for patches. If Google isn&#x27;t willing to wait the two additional days such that the patch can be deployed within the regular update window, this means that Google effectively gives MS only 60 days to react and fix issues (because once they missed the second patch day, the vulnerability will be disclosed before the third).<p>MS is a huge company with an immense installed base and they have to be understandably careful with pushing updates. Working with them to disclose vulnerability on their regular patch day really wouldn&#x27;t be such a bad thing for either Google nor the end users, even more so as we&#x27;re talking about two days here and there even was a holiday week in the timespan.<p>This is about being an ass and I see no advantages for end users.<p>Even if Microsoft had not responded to Google at all, they could have waited for full three patch days (again, MS&#x27; patch deployment timeline is very much public knowledge by now) before publicly disclosing the issue.
评论 #8874113 未加载
评论 #8874084 未加载
评论 #8873960 未加载
评论 #8874063 未加载
评论 #8874031 未加载
评论 #8873970 未加载
评论 #8874049 未加载
评论 #8874195 未加载
xxyyzz3d超过 10 年前
I think there is something to notice about having a hard fixed timeline for everyone. See from the bug:<p><a href="https://code.google.com/p/google-security-research/issues/detail?id=123" rel="nofollow">https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;google-security-research&#x2F;issues&#x2F;de...</a><p><pre><code> &gt; Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline. &lt; Microsoft were informed that the 90 day deadline is fixed for all vendors and bug classes and so cannot be extended. Further they were informed that the 90 day deadline for this issue expires on the 11th Jan 2015. &gt; Microsoft confirmed that they anticipate to provide fixes for these issues in January 2015. </code></pre> So basically Microsoft asked for an extra month, and they said no, which forced them to move quicker, and fix it a month earlier. Without picking any side of the debate, you can still see what effect the non-negotiation of timeline has on getting patches out as soon as possible.
评论 #8874151 未加载
WestCoastJustin超过 10 年前
TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January.<p>Personally, I don&#x27;t think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples priorities. There is a published 90 day policy, they gave 90 days notice, figure it out. There is also details missing about the communication between Google and Microsoft. Like when they asked for an extension, etc.
评论 #8873991 未加载
评论 #8874042 未加载
评论 #8874009 未加载
评论 #8874028 未加载
评论 #8874387 未加载
评论 #8873984 未加载
jnbiche超过 10 年前
Look, I&#x27;m been really happy with a lot of the stuff Microsoft has been doing recently, particularly in open source. But this is ridiculous. They had plenty of notice that Microsoft&#x27;s standard 90-day (90 day!) policy applied, and that no exceptions were going to be made.<p>I applaud Google for not bending on their 90-day deadline (assuming they do hold all companies to that, and it appears they do). Maybe this incident will help encourage some companies that might otherwise be lax when confronted with a bug to hurry up. There&#x27;s no telling who else knew about this bug and was actively exploiting it (probably lots of people).
评论 #8878629 未加载
评论 #8874137 未加载
forgottenpass超过 10 年前
&quot;Microsoft&#x27;s senior director of research Chris Betz said in a blog post.&quot;, &quot;Several security researchers&quot;, &quot;wrote one developer&quot;, &quot;But another said&quot;<p>So is this what the disclosure issue is going to look like when packaged up for the masses? No historical context on how the ongoing disagreements are the latest in decades of ongoing discussion? Or any mention of the events that shaped the popular ideas today? Just a sour blogpost and some bland quotes of agreement and disagreement from an internet so large you can always find quotes for the positions you want to portray. We&#x27;re so fucked.<p>Edit: And apparently it worked on us too. Of course external messaging is going to paint the other guy as the unreasonable one.
评论 #8874068 未加载
评论 #8874576 未加载
andyrj超过 10 年前
Google expended their resources to find a flaw in a MS product, in which MS was treated as any other vendor. If MS requires the ability to dictate the time alloted to fix their own mistakes, and are unwilling to change their own internal priorities for the sake of their own user base. Then perhaps, they should have found and fixed this prior to Google needing to point it out for them? I am amazed at the blind hatred for Google on this when MS has had a less than spectacular performance with its patches in the last year. Did all the MS fanbois forget about the bsod&#x27;s just a few months back from MS&#x27;s own &quot;flawless&quot;, as you all seem to believe, patch schedule? (MS14-045 and MS13-036) If this deadline, self imposed by MS, is so greatly beneficial to MS patching why didn&#x27;t the magic of patch Tuesday prevent those incidents?
LukeB_UK超过 10 年前
Everyone is saying that Google should have waited for Microsoft&#x27;s patch day, but why should Google bend their standard procedure to fit Microsoft? If it really meant that much to Microsoft, they could have released a patch earlier.<p>They knew they had 90 days and decided to ignore it.
评论 #8874303 未加载
评论 #8874513 未加载
评论 #8875303 未加载
sgdread超过 10 年前
You think that 2 days is nothing, but look at this from other perspective: first time MS asks for 2 days (BTW, as others pointed, initially MS said it&#x27;s not going to be fixed until Feb), next time they ask for a week: last time you gave us 92 days, couldn&#x27;t you wait for another 3 days? And then it goes, and goes. Then other company asks for a week. If google refuses, there will be unfair treatment and might cause bad press (much worse than this one). So as despite it looked like a dick move, I fully support google&#x27;s actions. If you compromise on policy once, you&#x27;re done. So 90 days is a 90 days, no matter what. I think it was a lesson to MS: take this policy with respect and avoid this in future. I&#x27;m a software developer and I know how difficult to fix big systems like Windows (burocracy must be crazy there), but the only way to challenge broken processes is to put pressure, otherwise it will never change.
valevk超过 10 年前
This is the issue: <a href="https://code.google.com/p/google-security-research/issues/detail?id=123" rel="nofollow">https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;google-security-research&#x2F;issues&#x2F;de...</a>
fixermark超过 10 年前
Turning the question on its ear a bit:<p>Even given that Windows 8.1 is a large and complicated machine, what was it about this particular bug that required basically all of Q4 for MS to patch it?<p>It&#x27;s one bug.<p>I have a sinking suspicion that MS simply didn&#x27;t consider it a priority, even after responsible disclosure to them, which is why it&#x27;s good that Google&#x27;s public disclosure policy is a hard-limit 90 days. Too many companies, when given the option to choose their own priority tree over the priority tree enforced by security needs, will choose the former.
jorgecastillo超过 10 年前
It seems reasonable for Google to release the details of the bug. If they make an exception for one company they&#x27;d have to start making exceptions for all companies. Microsoft is at fault here for not fixing this on time.
shogun21超过 10 年前
Isn&#x27;t this all MS&#x27;s fault for having a security flaw in their system?<p>If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window.<p>Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.
评论 #8874723 未加载
tptacek超过 10 年前
Graham Cluley isn&#x27;t a vulnerability researcher; he&#x27;s a blogger and former antivirus author. Old school antivirus people are like the opposite of vulnerability researchers.
jrockway超过 10 年前
I&#x27;m looking forward to the &quot;Scroogled&quot; ads and merchandise highlighting this issue.
doe88超过 10 年前
If I were MS I wouldn&#x27;t complain on this issue and instead I would just take the bait and put an internal team to find out bugs exclusively in Google products like for instance Android [1] and declare an arbitrary short disclosure policy [2] and then release these bugs when time is up.<p>[1] <a href="https://news.ycombinator.com/item?id=8874339" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8874339</a><p>[2] <a href="https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pleased-website-exploits-microsoft-zeroday/" rel="nofollow">https:&#x2F;&#x2F;nakedsecurity.sophos.com&#x2F;2010&#x2F;06&#x2F;15&#x2F;tavis-ormandy-pl...</a>
评论 #8876078 未加载
chappi42超过 10 年前
&gt; Then again what does Google care, they don&#x27;t use or support anything Microsoft, so it doesn&#x27;t affect them<p>What does Google care? I get the impression they care about not much else than ads and HUGE NUMBERS of users.
bagacrap超过 10 年前
The linked bug shows that it was discovered Sep 30 and revealed publicly on Dec 30. Thus MS missed the deadline by two weeks, not two days. I agree there should be some flexibility but where do you draw the line?
mark_l_watson超过 10 年前
What? Microsoft asked for 2 extra days and Google refused? Seems like an asshole move.<p>I am in general a huge Google fan, but in using Google services I realize that I am not much of a customer (I purchase extra storage and buy stuff on the Play Store); advertisers are the customers.<p>Microsoft on the other hand gets its money from computer users and it seems like they have a much more customer focused mentality.
评论 #8874091 未加载
评论 #8874080 未加载
Beltiras超过 10 年前
2 days leeway is not uncalled for. Bad form Google.
评论 #8873899 未加载
评论 #8873856 未加载
评论 #8873872 未加载
realcul超过 10 年前
Google please fix your issues [1] before you leak zero day issues about your competitor...<p>[1] <a href="http://www.zdnet.com/article/google-stops-providing-patches-for-pre-kitkat-webview-abandons-930m-users/" rel="nofollow">http:&#x2F;&#x2F;www.zdnet.com&#x2F;article&#x2F;google-stops-providing-patches-...</a>
dogpa超过 10 年前
Microsoft has been shipping steaming crapola for decades. Their unwieldy and unmaintainable codebase is their own fault. This should not be news to anyone who is unfortunate enough to have to use their awful products.<p>They sought to dominate the market by means other than having the best talent and shipping the best software. It worked but now they have a problem.<p>And who can forget this? <a href="http://blog.zorinaq.com/?e=74" rel="nofollow">http:&#x2F;&#x2F;blog.zorinaq.com&#x2F;?e=74</a> Developers developers developers.<p>Any vulns I find will not be dealt with in such a charitable manner. (i.e. you have exactly zero days to fix your shit).<p>Why on Earth are Google wasting their own resources doing Microsoft&#x27;s work for them?<p>Tiny, tiny violins, Microsoft. Tiny, tiny violins.
divs1210超过 10 年前
Microsoft will be celebrating a lot of Merge Days[1].<p>[1]: <a href="http://thedailywtf.com/articles/Happy_Merge_Day" rel="nofollow">http:&#x2F;&#x2F;thedailywtf.com&#x2F;articles&#x2F;Happy_Merge_Day</a>!
outside1234超过 10 年前
&quot;Do no evil&quot;<p>Unless it hurts a competitor and is bad for their customers.
评论 #8874590 未加载
wnevets超过 10 年前
Hasnt Microsoft released &quot;out of band&quot; patches before? Why is this one so special?
评论 #8876131 未加载
franzwong超过 10 年前
How about Google sponsors Microsoft human and financial support to fix the bugs if they really care about that?
presootto超过 10 年前
Google is just a bunch of hypocrites. Do you remember what happened when they&#x27;re new ReCaptcha was reverse engineered?<p>Let me remind you: <a href="https://news.ycombinator.com/item?id=8728336" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8728336</a><p>Disclaimer: I work for TAGA (The Arrogant Google Assholes)
评论 #8874010 未加载
评论 #8874974 未加载
评论 #8873911 未加载
k-mcgrady超过 10 年前
*repost of my comment from another post on this subject[1]<p>&gt;&gt; &quot;Google&#x27;s Project Zero seeks to find bugs in popular software and then give the manufacturers responsible 90 days to fix the problem.&quot;<p>Seems reasonable.<p>&gt;&gt; &quot;On 11 January, Google publicised the flaw. Microsoft said it had requested that Google wait until it released a patch on 13 January.&quot;<p>Dick move. Sorry, I can&#x27;t think of any other way to describe it. They may have waited until the last minute (or maybe they really did have to rewrite a tonne of code) but that&#x27;s no excuse or putting users at risk when you can wait two days. Seems more like a marketing tactic than a desire for faster security patches.<p>[1]<a href="https://news.ycombinator.com/item?id=8873704" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8873704</a>
droopybuns超过 10 年前
A few observations:<p>Google headcount: ~49k MS headcount: ~130k<p>There is going to be a huge difference in speed based on size alone, but MS also has a much greater commitment to regression testing than Google ever has.<p>Google has embraced an engineering culture where the security team can contribute fixes directly to their own projects. I imagine this creates an unreasonable prejudice culture about how easy it is to implement fixes without concern for regression issues. You can see examples of this in recent e.o.y will not fix bug closures in AOSP. Those savants are going to set the usability vs security debate back a decade by by marking all http connections as insecure.<p>Finally, don&#x27;t forget that Eric Schmidt agreed to a recruiting cease fire. For. All of their pride and arrogance, those Google security engineers are never going to escape the fact that they have compromised their own potential maximum value so they can sneer at other companies cultures.<p>Toxic and stupid.