Hacker News Reader

Comment by nishsin | Hacker News Reader

Just a quick question for anyone more knowledgeable, has Project Zero ever bothered reporting or investigating any Google products, such as their clusterfuck of an OS more widely known as Android as I'm pretty sure that would be full of exploits if anyone was seriously looking for them.

View on HN

Yes they have, here's one example: https://googleprojectzero.blogspot.com/2018/09/oatmeal-on-un...

I don't know about Project Zero in particular, but yes, Google has security teams investigating their own projects. Why would you think otherwise?

And if you think there are security holes, you're welcome to report them to get a bug bounty.

I think it might be just harder to find exploits in your own code because of organizational blind spots.

Well personally I would like it if they had write up's on them, even if only after the fact, as Project Zero has always come across to me as kind of a publicity stunt to try to improve their reputation to the tech industry and show how important they value security when the truth is quite different.

What is the truth in your view?

If there is bias it would be a good for us all in the end imo. Makes it more likely for Googles competitors like Apple to spin up similar teams and fund them aggressively to find exploits in Google tech like Android.

It is probably just a consequence of Project Zero being made up of experts on different topics. The iOS experts are quite prolific.

If you navigate to https://googleprojectzero.blogspot.com the first story is about a vulnerability in skia, a library made by Google:

https://googleprojectzero.blogspot.com/2019/02/the-curious-c...

Yeah, it's amazing that this is not called out more often. Android is a security mess.

Anybody can make an android phone and damage the brand. Compare pixels to iphones in pwn2own contests. They are at the very least equivalent.

That covers the 3 million phones a year that Google sells what about the other 1.2 billion plus?

https://www.forbes.com/sites/chuckjones/2018/03/10/apples-io...

If you are worried about Google's security practices, why look at things other than Google's products?

Android is as much a Google product as Windows is a Microsoft product.

No one would say that if you want a PC that is secure, buy a Microsoft Surface.

> Yeah, it's amazing that this is not called out more often. Android is a security mess.

Nope, Android security is quite good actually. Not as good as iOS, however very good nonetheless.

Of course, fragmentation issues and the fact that most Android devices are not updated do not help.

However there is active mitigation of security issues both in kernel and in Android user space.

Just to complemented my previous comment, Android is probably one of the most secure Linux based devices in the world, probably only losing to ChromeOS.

Reply on news.ycombinator.com