I have a serious question.
I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?
I understand the benefit of this program to the public, but what real benefit does funding Project Zero Day provide Google?
1. Google uses Mac OS and Windows internally, they're a big enough company that even untargeted malware that hits a small percentage of systems costs them money (not to mention targeted malware), and they're also a big enough company that the amortized cost of Project Zero, across all employees, is affordable.
2. The top-notch researchers who find vulnerabilities in their server stack (Linux, etc.) also like looking at different OSes occasionally, and this is a way of recruiting and keeping them at Google, which leads to them disclosing and fixing Linux security issues internally while waiting on an external response.
3. They're unhappy with their software vendors not taking security and vulnerability response seriously, and they're trying to shift the popular consensus / Overton window on how seriously people should care and what the industry-standard response to reports should be.
A common monetization method used by malware distributors is to secretly replace legitimate ads that get loaded on the machine (such as Google's) with their own.
Doing this on every single web page visited by that machine for the rest of its existence, and multiplying that by hundreds of thousands of other infected machines out there, and multiplying THAT by the dozens of different black hat groups doing this simultaneously, it adds up to a lot of lost money for Google.
To me it feels like they're throwing their competitors under the bus in this way as opposed to running slander campaigns or witty commercials like Samsung, Microsoft, and Apple do. I'm not saying this is their intention but that is the way it comes off and it cannot be good for their reputation.
A non-profit organization funded by the entire tech industry would have more credibility.
They do offer a bug bounty for their own products, to encourage third parties to do to them exactly what they're doing to Apple and Microsoft.
Of course, it's an uphill battle with the manufacturers/carriers. But as long as Google is not applying fixes to Jelly Bean, the manufacturers can always blame Google.
[1] http://www.androidpolice.com/2015/01/23/google-issues-offici...
[2] https://developer.android.com/about/dashboards/index.html
Edit: for the apparent doubter of this, see any number of articles about Google's 40,000 macs that they use as dev machines, for example: https://www.usenix.org/conference/lisa13/managing-macs-googl... http://www.theregister.co.uk/2013/11/27/google_mac_support/
Source: worked there once
(I'm a Googler)
Not everything has to be directly linked to selling ads, Google is a group of people. Some companies plant trees, Google has this, I guess.