> Google's security analysis efforts are appreciated and benefit the Android platform, however a company as powerful as Google should practice more responsible disclosure timing than this, and not endanger users in the course of its counter-PR efforts against Epic's distribution of Fortnite outside of Google Play.
And Google expects researchers to disclose bugs on their platform to them before disclosing to public.
type: vulnerability is new, but if you search the public bug tracker for the phrase "This bug is subject to a 90-day disclosure deadline", you can see it all
It looks like they have been pretty darn consistent about unrestricting once the patch is available. Usually faster than 7 days! They have also consistently held people to the 90 day requirement, and the 14 day grace extension they offer This is true even when the reporter is a googler or it affects only google software.
This literally took me 5 minutes to look at and analyze.
Instead of bothering to even look, epic decided it'd be better to issue a press release (as part of their pr efforts, ironically enough).
If they want to complain (like others have!) and debate what the policy should be, that is one thing.
However, the complaint that Google has treated them differently is clearly false.
If they want to argue otherwise, the data is all right there for them to use.
From the article linked above:
> Avoiding the 30 percent "store tax" is a part of Epic's motivation. It's a high cost in a world where game developers' 70 percent must cover all the cost of developing, operating, and supporting their games. And it's disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We're intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.
> Google's security team first disclosed the vulnerability privately to Epic Games on August 15, and has since released the information publicly following confirmation from Epic that the vulnerability was patched