Google reveals MS insecurity before MS can fix it

Moderators: b1o, jkerr82508

User avatar
viking60
Über-Berserk
Posts: 9351
Joined: 14 Mar 2010, 16:34

Google reveals MS insecurity before MS can fix it

Postby viking60 » 20 Jan 2015, 23:07

Microsoft is cross with Google again because they have discovered an insecurity in Windows 7 and Windows 8.
The thing that annoys Microsoft is that Google disclosed the insecurity before Microsoft was able to fix it.

Furthermore Google gave a description on how the insecurity "worked".

Microsoft wrote a blog calling for a Better Coordination of vulnerability disclosure.

Calling for the "Industry" to do this differently. So they are angry at Google for publishing it.

On the other hand Google does allow 90 days of fixing before they publish:
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.


This seems fair and should be enough for a billion dollar company with more employees than a city to fix the bug.

People would expect a serious vulnerability to be fixed in that time. +1

Microsoft could use this as a smokescreen because Google found the vulnerability in Windows 8.1 despite all control and "secure booting".

The argument of security is weakened - leaving the control aspect.

By the looks of it: the main reason for secure booting is to secure that the computer can only boot Windows.

Some food for thought Microsoft :
Rather than complaining at the "Industry" and other companies; wouldn't it be a great idea to simply implement a maximum 90 days fix strategy?

How many days are needed to fix serious bugs?
Manjaro 64bit on the main box -Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz and nVidia Corporation GT200b [GeForce GTX 275] (rev a1. + Centos on the server - Arch on the laptop.
"There are no stupid questions - Only stupid answers!"

Return to “Win News”