Hacker News Reader

Comment by jacksmith21006 | Hacker News Reader

Yes Google allows longer for bigger issues. Meltdown and Spectre two great examples.

What surprises me is that so many of the really big ones seem to be found by Google.

Spectre and Meltdown by multiple poeple. But Shellshock, Broadpwn, Heartbleed, and Cloudbleed if memory serves all found by Google.

Off the top of my head can not think of a major one the last couple of years found by anyone but Google. Anyone else?

View on HN

Project Zero remains one of the few true gems at Google. They do good work. They probably don't call out their own employer as much as they should (understandable, considering), but they do darn good work, and have made a significant impact in making the Internet more secure. Everything from competitors' operating systems to browser extensions has gotten their attention, almost seemingly at random.

I'd actually be super curious to know how they pick what they look into. Just a "hey, I wonder about this" while going about their day, or if they have some sort of agenda laid out for when to look at what software.

They probably call out their employer internally, know who to call directly when they find something, and so on. For stuff that isn't their own, the rules are probably very different.

At least that is how I would run something like this.

If I recall correctly a bug in chrome was disclosed before Google could fix it by the project zero team as the 3 month deadline had passed.

Would say Google has a couple gems. DeepMind comes to mind. Also Google Brain has done some pretty interesting things.

Probably my favorite of late is from Jeff Dean

https://arxiv.org/abs/1712.01208

We just got YouTube TV recently and also something that is pretty impressive by Google and saves me a ton of money as my cable provider was awful charging for every TV monthly.

Another example of something I find really interesting is Spanner.

https://research.google.com/archive/spanner.html

Those who put resources into looking for security vulnerabilities find a lot. Of those groups, most have better things to do with those vulnerabilities than report them publicly. Who else is Google even competing against here?

There are lots of other vulnerability research teams. Google happens to have one of the best; they've recruited a decent slice of the best-known vulnerability researchers and then done a pretty excellent job of bringing up new people.

Shellshock, Broadpwn were not originally reported by people working at Google, Heartbleed was also independently found by others.

Reply on news.ycombinator.com