Hacker News Reader

Comment by MaxBarraclough | Hacker News Reader

I'm not convinced.

Google's policy seems about right to me. When they discover a security flaw in someone else's software, they give them 90 days before making it public [0]. The choice of 90 days is to strike a balance between applying strong pressure to the company to get it fixed fast, and giving them a reasonable amount of time to get it done and rolled-out. My understanding is that this approach generally works fairly well.

You'd rather that they adjust that notice period all the way down to zero, and hand vulnerabilities over to the bad guys for free right out of the gate?

[0] https://arstechnica.com/information-technology/2015/02/googl...

View on HN

You are assuming that the white hat security researcher was the first to discover the flaw. That is a perfectly reasonable assumption, and your position is perfectly reasonable given that assumption.

GP was assuming that the white hat security researcher was not the first to discover the flaw, and that the flaw is actively being used to attack users. That is a perfectly reasonable assumption, and GP's position is perfectly reasonable given that assumption.

That's still not enough. Even if bad guys are already using the exploit in the wild, it still isn't responsible to immediately make it public. If the exploit isn't already public, that means the bad guys are treating it as something to be traded in secret. (And of course, the only reason we're discussing this is that the exploit is not already public.)

Instantly publishing the details of the exploit may well broaden its use by bad actors, by reducing its market price to zero.

There are dedicated teams of people who are highly skilled, well-funded and working full time at finding exploits with the intent of selling or using them.

The bad guys already have the vulnerabilities long before the good guys do.

Lower-skilled criminals and script kiddies who are relying on disclosure before they can do anything are far less ambitious and do far less damage.

Stuxnet and recent high-profile banking malware all employed legitimate 0day and did real damage to people. Vulnerability disclosure contributed nothing towards that.

But I'm not saying this to convince you, I'm saying this to keep my stuff secure. Google doesn't choose 90 days out of a sense of anything other than what's good for Google and its shareholders.

Any vulnerability a white-hat finds is already for sale to criminals and governments on Russian dark-web forums anyway.

See my reply - https://news.ycombinator.com/item?id=18309062

Reply on news.ycombinator.com