Google Proposes "Know, Prevent, Fix" Framework For Dealing With Security Vulnerabilities

[Paradigm Shifter]

So much hate towards Google that people rally against it even when they're actually doing something good.

While I understand your point, when any entity has repeatedly shown itself not to be working toward the goals that they publically espouse, it should be treated with... if not suspicion, certainly wariness.

Google got where it was because people believed the "don't be evil" tagline they publicised. Notice how they dropped that (2015?) as soon as they had such a dominant position that the only way to de-Google the internet would be basically wipe out the internet as we know it and start again from dial-up BBS.

The really frustrating thing is, even if you try hard to avoid Google, sometimes you just don't have a choice - where I work recently moved from their own in-house e-mail servers to G-Suite.

edit: They also have a history (recently, too!) of making poorly patched or unpatched zeroday vulnerabilities public. This was against Microsoft, so there is definite corporate interest in "one upping" the competition there, but will they do the same to anyone they wish, despite this proposed framework?

[vladpetric]

While I understand your point, when any entity has repeatedly shown itself not to be working toward the goals that they publically espouse, it should be treated with... if not suspicion, certainly wariness.

Google got where it was because people believed the "don't be evil" tagline they publicised. Notice how they dropped that (2015?) as soon as they had such a dominant position that the only way to de-Google the internet would be basically wipe out the internet as we know it and start again from dial-up BBS.

The really frustrating thing is, even if you try hard to avoid Google, sometimes you just don't have a choice - where I work recently moved from their own in-house e-mail servers to G-Suite.

edit: They also have a history (recently, too!) of making poorly patched or unpatched zeroday vulnerabilities public. This was against Microsoft, so there is definite corporate interest in "one upping" the competition there, but will they do the same to anyone they wish, despite this proposed framework?

Personally I strongly prefer gmail to other services (nothing comes remotely close to searchability of gmail), and that I use it at work is a strong plus for me.

And the thing is that there's nothing remotely magic in searching email (Microsoft has Bing, which is a pretty decent search engine, yet somehow they can't do something usable for Exchange, for instance).

It's totally fine to hate them for having a dominant position. But I don't see much of a connect between that and what they're doing in the Open Source arena.

Also are you saying that they made zerodays public without any waiting whatsoever? Also do you have a link for that?

[Sonadow]

Google is also suggesting no unilateral changes to "critical software" but ensuring code involved is looked over by an author and a reviewer/approver to limit the impact of any single individual.

Try telling the leaders of various projects like libpng, libjpeg-turbo, openssl, ffmpeg etc that they are not allowed to make 'unilateral' changes to their own projects just because they are critical software in the FOSS world.

Please go fuck yourself, Google.

[Paradigm Shifter]

Personally I strongly prefer gmail to other services (nothing comes remotely close to searchability of gmail), and that I use it at work is a strong plus for me.

And the thing is that there's nothing remotely magic in searching email (Microsoft has Bing, which is a pretty decent search engine, yet somehow they can't do something usable for Exchange, for instance).

Yes, it frustrates me that Outlook is so poor at searching e-mail. I can search in Thunderbird and find e-mails almost immediately, but Outlook? Slow, clunky and occasionally manages to not find the e-mail I'm actually searching for, despite the same search in Thunderbird bringing it up without any problem! Reported? Yes, many times. Fixed? Not since Outlook 2010.

I dislike webmail in general. After many, many years of Yahoo! Mail, I use webmail only as a desperate last resort.

It's totally fine to hate them for having a dominant position. But I don't see much of a connect between that and what they're doing in the Open Source arena.

Also are you saying that they made zerodays public without any waiting whatsoever? Also do you have a link for that?

I don't hate them, certainly not for being the dominant player in the market. Distrust is not hate. Sadly, you cannot disconnect one section of a company from another, its all part of a whole.

No, I did not say that they make zerodays public without any waiting whatsoever. But there are various stories (I remember a couple reported on Phoronix) across the years. Now there are often mitigating circumstances (evidence of attack already being used in the wild, or Microsoft being slow) however whether actively advertising it is a good idea or not? The debate isn't going to stop, and I do not know which "side" I agree with more, as there are good and bad arguments for both sides.

[ddriver]

So much hate towards Google that people rally against it even when they're actually doing something good.

They are not driven by an intent to do good. They are driven by an intent to make money on people, which backfires and taints IT services, so this is but a mitigation, a band aid that will merely hide the nasty festering wound, but do nothing to treat the underlying infection.


They are trying to facilitate keeping IT services corrupt and exploitative, rather than to make them better. They are merely addressing a symptom, not the root issue. It is lipstick on a pig.

Google doesn't do good, I mean on the absolute scale, nothing of what it does has benefits to society that outweigh the benefits to itself. It only gives when that enables it to take more.

[f0rmat]

Maybe they will start by looking at streamlining their android code. A vanilla android install is about the same size or larger than a vanilla Win95 install. Win95 had to run on more types of hardware and had its own inefficiencies and bloatware in it, but it was, is, still on par or lighter than a vanilla android install. It amazes me when I update my phone apps at how large some of them are - 65 megs here, 120 megs there, etc. What is even more annoying is that most of them are just taking up drive space because I never use them and I cannot uninstall them. All I can do is remove all the permissions from them and have them reside on the phone taking up space.

[Paradigm Shifter]

What is even more annoying is that most of them are just taking up drive space because I never use them and I cannot uninstall them. All I can do is remove all the permissions from them and have them reside on the phone taking up space.

And being a potential security risk, from what I understand, as if they're installed, then they can be accessed/run? Might depend on the Android version, though.

[f0rmat]

And being a potential security risk, from what I understand, as if they're installed, then they can be accessed/run? Might depend on the Android version, though.

They might be a possible security risk, but I mitigate that by removing all permissions and all access capability. It takes awhile as Android likes to hide that in two different locations.

[bug77]

They are not driven by an intent to do good. They are driven by an intent to make money on people, which backfires and taints IT services, so this is but a mitigation, a band aid that will merely hide the nasty festering wound, but do nothing to treat the underlying infection.


They are trying to facilitate keeping IT services corrupt and exploitative, rather than to make them better. They are merely addressing a symptom, not the root issue. It is lipstick on a pig.

Google doesn't do good, I mean on the absolute scale, nothing of what it does has benefits to society that outweigh the benefits to itself. It only gives when that enables it to take more.

Yes, sure, because you'd totally subscribe to a search engine. And email. And a maps service. And online storage. And a news service. Google is obviously evil for providing all that free of charge.

Also, wth does Google's business model have to do with software vulnerabilities?

[Sonadow]

They are not driven by an intent to do good. They are driven by an intent to make money on people, which backfires and taints IT services, so this is but a mitigation, a band aid that will merely hide the nasty festering wound, but do nothing to treat the underlying infection.


They are trying to facilitate keeping IT services corrupt and exploitative, rather than to make them better. They are merely addressing a symptom, not the root issue. It is lipstick on a pig.

Google doesn't do good, I mean on the absolute scale, nothing of what it does has benefits to society that outweigh the benefits to itself. It only gives when that enables it to take more.

And in today's Obvious lesson brought to you by Captain Obvious, businesses exist to make money for its stakeholders.