Hacker News Reader

Comment by dguido | Hacker News Reader

FFS people, this is called MAPP and the program has been public and a huge security success for the last few years. Microsoft advises lots of security companies about patches slightly before they are issued. That way, everyone has options on day 1 and people aren't scrambling for additional mitigations every Patch Tuesday.

If you want to be outraged, check out all the Chinese companies on the list of partners!

https://www.microsoft.com/security/msrc/collaboration/mapp.a...

View on HN

Funny you mention this, because I don't see US Government, Department of Defense, or the Natural Security Agency on that list (not that I expected to find them there in the first place). Also, last I checked, the purpose of MAPP wasn't to allow MAPP-partners the ability "to exploit vulnerabilities in software sold to foreign governments"... And indeed, that would only compound the problem (have a look at the last question on the MAPP Application Request: "Do you sell or create products used to attack or weaken the security posture of networks or applications?").

> If you want to be outraged, check out all the Chinese companies on the list of partners!

Wow, really? :|

I might be outraged if I saw Government of China on that list, but the majority of Chinese companies on that list are large telecommunications companies (like Huawei) or Chinese-based antivirus companies. And even then, Chinese-based companies only make up a fraction of the (unsettlingly large) list.

its important to note, the government of china has a controlling stake in a large number of those companies.

I feel it's equally important to note, we don't know which companies on that list are a front for the CIA.

Thats because there is more than one program providing this sort of information. MAPP is for AV and other security software companies. There is also: CIPP http://www.microsoft.com/security/cipp/ and another one for "Defence" which is all government, military and intelligence agencies (apparently).

Natural Security Agency ... hah!

... the intelligence branch of the Department of the Interior?

> last I checked, the purpose of MAPP wasn't to allow MAPP-partners the ability "to exploit vulnerabilities in software sold to foreign governments"

The phrase you quoted is utterly meaningless, and the article provides absolutely no evidence that the vulnerability notifications are used for that purpose.

It's just an anonymous source is saying "with knowledge of unpatched vulnerabilities, the government could exploit that knowledge." Obviously! With knowledge of unpatched vulnerabilities, YOU could exploit that knoweldge. Anybody could. What of it?

The quote is garbage.

I think the US government is not on the list because they don't need this program. The NSA finds its exploits directly from the source code, which Microsoft shares with them and many other governments, not second-hand from Microsoft.

This is already being spun on some media as if MS intentionally delays fixing bugs to let the government take advantage of exploits.

http://news.yahoo.com/microsoft-waits-fix-software-bugs-nsa-...

They don't need to delay : just giving early access to the US government is sufficient to enable offensive capabilities.

This program may have been publicly ongoing, but it is no less scandalous. Do you really believe that this early access to information will not be used for offensive ends ? How is that respectful of Microsoft's other customers, such as other governments ?

Reply on news.ycombinator.com