This one gets a bug tracker entry.
When Project Zero posts a lengthy analysis with lots of scurious claims about the victims of the exploit, the window of exploitation, and narrative about the poor development practices that led to it, then call it even.
If it follows the traditional pattern, they'll write a post blaming some external party. No, seriously, when people point out all of the "Android" faults they've found invariably it is some variation of "but it isn't really Google's fault....".
Project Zero is brilliant, full of brilliant people, and is a remarkable effort, but when your paycheque is signed off by someone, it is human nature that you're really going to pussyfoot with them.
For now. A comment from the reporter on the bug tracker entry:
>A more detailed explanation of this bug and the methodology to identify it will be written up in a forthcoming blog post when I find the time.
Apple has started multiple keynotes by talking about Android security issues. Pointing fingers and ridiculing Google, Samsung and others.
Then a few weeks later, a Google keynote would demo something on an iPad and praise its beautiful hi-def screen.
I have _never_ heard Google officially talk crap about Apple.
Historically, they didn’t directly identify other vendors, but strongly implied it so it was obvious to most without directly saying names. This has changed a bit recently and I feel isn’t a good thing.
> I have _never_ heard Google officially talk crap about Apple.
No offense, but then you aren’t paying attention. There are examples given directly in this thread already.
A minor windows exploit is found, and they publish "Windows Exploitation Tricks". An iOS exploit is found and they do a six part "very deep dive into iOS Exploit chains".
Now, they find a bad Android exploit and they don't publish anything.
However, I do think some of the motive is to take a bit of shine off Apple - meaning it's partly a marketing campaign.
Will there be a large analysis how frequently this was exploited and so forth? How about a public Google blog post around this?
Was there a Project Zero blog post before those comments went public that I missed?
[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
Because if this wasn't announced on their blog I'm going to have to say that this particular case would not be an apples to apples comparison.
Here was the Project Zero blog post on Apple's exploit, for comparison.
https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=14...
[2] https://bugs.chromium.org/p/project-zero/issues/detail?id=17...
[3] https://bugs.chromium.org/p/project-zero/issues/detail?id=19...