Hacker News Reader

Comment by gtirloni | Hacker News Reader

What's the incentive for Google in doing this?

http://googleprojectzero.blogspot.com/2014/07/announcing-pro...

Google's goals are so grand they see things like securing software and getting faster broadband everywhere as things worth doing. I've been reading their blog since launch and the team is very skilled, professional and interested in proving theory with actual exploits.

They fight back exploit peddlers like Zerodium or criminals who sell their findings to the highest bidder. You know, PR. They're basically do a huge service to their users and software companies by allowing the best exploit finders to focus on some software and then responsibly disclose their findings to the vendors, free of charge.

http://googleonlinesecurity.blogspot.de/2014/07/announcing-p...

The headline is kinda silly in the sense that if Project Zero focuses on any software in the world, they'll most likely find exploitable vulnerabilities. With Kaspersky the ridiculous thing is that they have stuff compiled without /GS, which e.g. since VS2005 has required you to actively disable it, as it's on by default.

It's slightly more than PR... Google sees the trustworthiness of people's interactions online as an existential necessity for the company. Things like tradeable zero-day exploits are a risk to the entire business model of having people search for things and conduct business on the Internet.

Maybe Google could only hire people of this caliber if they let them spend some of their time doing work they will be able to talk about, besides the work on securing Google's internals which must remain secret.

It seems like a pretty straightforward grey hat operation to me. Google pays crackers to find competitors' vulns, publishes them to give said competitors bad PR, and maybe even gets a bit of good PR for itself for "internet security" mumbo-jumbo.

Reply on news.ycombinator.com