Hacker News Reader

Comment by tedivm | Hacker News Reader

Your first point is actually the main problem here- according to Google's internal memo they didn't have the logging data to support a full investigation and have no way of knowing whether a breach occurred or not. If you find a vulnerability and there's no way to prove it hasn't been exploited then the responsible thing to do is treat it as if it had been.

View on HN

Rarely is it ever the case that you can conclusively rule out exploitation (ever) of a discovered vulnerability. Most of the time, companies don't even check; they fix the problem and get on with their lives. That Google even bothered to figure out the limits of what they could conclude about the vulnerability is already above the standard response in the industry.

How do you feel about the log retention period?

I don't care about the log retention period. My assumption is that Google does a better job of real-time log monitoring than most other tech firms, and that they are between a rock and a hard place with respect to retention owing to privacy concerns. Either way: it's simply not a real-world norm to conduct a forensics investigation after the internal discovery a vulnerability, so any work they did in that regard easily clears the industry bar.

You're absolutely right! That's very much the responsible thing to do for internal purposes.

That said, it might be slightly less than maximally honest for press outlets to claim that the one scenario is factually identical to the other to a public that is ill-equipped to appreciate the point you have so wisely made.

At this juncture, I think it's fair to say that Google's internal worries about public response were well-founded. They're being publicly crucified for going above and beyond the common standards of responsible behavior here.

Reply on news.ycombinator.com