Hacker News Reader

Comment by olliej | Hacker News Reader

I feel part of this is Google published a very large article about the iOS vulnerabilities, but did not do the same for the Android and Windows attacks that were also reported - just not by Google.

Given Google has already gone down the "use our security posts to discuss competitors bugs but not our own", it seems entirely reasonable for other companies to start treating the PZ blog as a marketing tool.

View on HN

> Given Google has already gone down the "use our security posts to discuss competitors bugs but not our own"

Project Zero finds and publishes bugs for most major platforms. Just look through their archives: https://googleprojectzero.blogspot.com

Yet this very large post detailed only the iOS vulnerabilities in the "large scale untargeted attack" that also had android and windows vulnerabilities.

It does not take a genius to read that article and realize that the omission of the other targeted platforms was intentional.

They dropped five 0-day web chains against a platform where this was largely unheard of. I think this is significant enough for a blog post. FYI, Project Zero mentions when other bugs they find were found being exploited: https://googleprojectzero.blogspot.com/search?q=in+the+wild

How many Google bugs have received the same volume of exposition as this Apple bug?

No idea, but here are some Android write-ups I grabbed:

https://googleprojectzero.blogspot.com/2016/09/return-to-lib...

https://googleprojectzero.blogspot.com/2019/03/android-messa...

https://googleprojectzero.blogspot.com/2015/11/hack-galaxy-h...

Here's some about Chrome:

https://googleprojectzero.blogspot.com/2016/11/breaking-chai...

https://googleprojectzero.blogspot.com/2014/10/did-man-with-...

https://googleprojectzero.blogspot.com/2019/04/virtually-unl...

Now see if any of those were reported in the mass media. Not The Verge. Not Vice. No tech publications. Front page of BBC news, The Washington Post, NY Times, etc.

That is not PZs problem.

It is when they submitted the Apple releases to all these venues the day Apple's keynote invites dropped.

Make up stories to prove your point.

The OP was using examples from PZ as a rebuttal to the GP asking if any Google products getting widespread coverage. The provided links are completely and utterly irrelevant. Your average commuter was reading about how terribly insecure iOS is based on PZs report being sensationalised in the media at large. The “tech” journalists write based on these articles, therefore PZ need to lay out the all the facts.

PZ posts on it's blog. What gets picked up by other media as news is not their mandate.

To be fair, this is a highly unusual situation, with long chains of interesting and complex vulnerabilities and multiple zero-days against probably the most scrutinized consumer device currently.

Most Google bugs are… much less interesting.

Independent security researchers are comparing this to the "Aurora" hack of Google[1].

While that was undoubtedly of a larger scope, it was also the event that led to the creation of P0, so it would make sense that this gets more exposure than your average bug report. Most security bugs aren't multi-exploit zero-day chains found in the wild being currently used to oppress people by a state actor.

[1]: https://twitter.com/alexstamos/status/1170064458003054594

Frankly, it does feel like they publish more heavily on non-Google products. Which isn't to say that they don't publish many articles on Android and Chrome and other core Google things, but just look down that list and you'll see many many more iOS/Windows articles than Google ones.

You can interpret this many ways. Maybe they're casually discouraged from publicly talking about threats against Google software. Maybe competitors' software is just more vulnerable. Maybe the team shifts focuses every once in a while, and in 2019 they've just been on a real Apple/Microsoft kick. I don't know.

My general position is: Google The Company has done nothing at all to deserve the public's trust and good intentions, and I don't see why that position shouldn't extend to the Project Zero team. Its a garbage company, and the publications from the very talented and dedicated people on that team may be better interpreted in a more unbiased environment where we don't have to constantly be raising questions like "are they unfairly focusing on competitors products" or "are they giving internal teams the same time to remediate that they give competitors"?

It's a "garbage company". Yeah right. Go outside your bubble and travel a little. See how many peoples lives have changed due to Google.

PZ has regularly posted against its own (Google) bugs.

Reply on news.ycombinator.com