Hacker News Reader

Comment by ErikAugust | Hacker News Reader

Project Zero is taking names lately. I wonder if other firms will "retaliate" with their own Project Zero-style security teams.

View on HN

That's the kind of retaliation I can get behind whole-heartedly :-)

Yeah, there would likely be a real net-positive to corporations trying to damage each other's credibilities via security disclosures. (No sarcasm - I believe it).

If they can't manage to fix a severe security hole within 90 days, I'd say that they deserve to have their credibility destroyed.

I'm with GP on that we need more programs like project zero.

Unless, the retaliation is done by the NSA where they don't want any more of their precious 0 days getting leaked.

NSA guy #1: "Hey, Fred, Google released another Microsoft zero day. Those things cost us millions to buy. Can we punish Google somehow?"

NSA guy #2: "Sure, let's release our Google zero day!"

#1: "Oh, but didn't we spend millions on that?"

#2: "Yeah, but it'll really screw up Google!"

#1: "Okay, do it."

Google: "Oh my, thanks for pointing out that exploit. We're so glad the NSA is getting back to its mandate to alert American companies and organizations when it had identified security holes. And....fixed. Let us know if you find any more!"

Thanks NSA! Where do you want us to send the bounty award to?

No need, it's already been debited from your account.

Google Project Zero: burning NSA budgets since 2014!

pretty sure they can afford it ;)

Why else do you think the US needs a 10% military budget increase?

I feel like you might be sarcastic, but I really do think so.

No sarcasm, I think so too.

We are going to make the world a better place out of petty spite!

Yes, I'll happily support Microsoft finding bugs in all the Android devices on the market. No to mention it would be paid work anyway, considering the billions of dollars a year Microsoft is making extracting royalties for bogus patents from Android OEMs.

Please get angry and do it Microsoft! Show Google how it's done.

The sad part is that the majority of Android users won't see those fixes anyway.

That would be really really bad considering none of the Android OS get any update ever.

I hope they do! If this sort of team becomes commonplace we may have a good shot at a lot better standard level of security. (Or we may have a chance of it devolving into a corporate shitshow between rivals, idk... I can hope though)

Disclosure: work at Google, but very far away from security.

I believe Google would be happy to see more people funding security research.

> I wonder if other firms will "retaliate" with their own Project Zero-style security teams.

If all the companies would to that it would be good for security

It's their new marketing department I heard ;-)

Reply on news.ycombinator.com