Hacker News Reader

Comment by Analemma_ | Hacker News Reader

No, "hypocritical" would be disclosing critical vulnerabilities in a competitor's product after a week of notification, when you yourself stop shipping security updates for your mobile operating system after two years; instead suggesting "buy a new phone!" as the solution. But no one would be that sleazy.

View on HN

Not only is that not hypocritical (I would try actually looking up the definition, for one), it would also be monumentally stupid for security researchers to wait until all products at their employer are fixed before disclosing outside vulnerabilities.

Agreed. Though Analemma_ has a point about Google's decision not to provide security updates to Android devices/OSs which are just 2 years old.

It's 3 years of security updates for Pixel and Nexus phones.

And that's a minimum guaranty. We have yet to see if they truly stop or keep going.

No? We've seen Nexus devices being dropped after only 16 months of support.

I don't believe that's true. The shortest update life span was the 2011 Galaxy Nexus for 20 months. Ever since then the models have been updated for 3 years or more.

No? They got 2.5 years of security updates after release (and not 2 years of security updates after sale, as EU law demands), and they certainly only get 18 months of feature updates after release.

The Nexus 5 was already dropped in October 2015, having been released in October 2013.

Same with the Nexus 6 (it was dropped yesterday, being 2 years old).

It’s always been 18-24 months of updates max, and only if you buy on release day. https://support.google.com/nexus/answer/4457705#nexus_device...

That page you linked to says otherwise

> Nexus devices get security patches for at least 3 years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer.

Google is still releasing security patches for Nexus 5

http://www.androidpolice.com/2016/08/01/august-security-patc...

The most recent one for Nexus 5 aka Hammerhead was this month: M4B30X, Oct 2016

https://developers.google.com/android/images

You're mistaking the major version releases (6.x.x vs 7 x.x) with security patches, they are not promising major updates here only security patches for 6.x.x.

> or at least 18 months from when the Google Store last sold the device, whichever is longer.

Which is illegal, EU law demands 24 months from when it was lost sold anyway.

> they are not promising major updates

That’s another issue, many security features are only added in major updates (sandboxing Mediaserver, etc).

So you only get hotfixes, and not long-term fixes.

Sure but Google profit from 'Google Experience' devices - ie, anything that ships Gmail, Maps, Play Store - and don't push licensees like Samsung / HTC / LG / Sony etc to maintain these devices.

If IoT security wasn't even worse Android would have been the new botnet platform.

I can't tell if the Windows versions affected are still supported. It would be only hypocritical if Google has refused to patch a vulnerability in their supported OS before 7 days after it was privately disclosed with them. Android support term being too small is another problem.

Yes, it's far better to not inform the public that their computers are being infected by an active Windows zero day.

I see where he's coming from though. It is hypocritical that Google cares so much about Microsoft's customers and then craps on their own user-base so regularly. Case in point: Google released the app launcher for Linux, waited for adoption to take place (so that devs and users had apps made, tested, installed, and in-use) and then they canned the whole thing because it was taking market share away from Chromium. Then, they canned Chromium OS!

If I were Microsoft I'd tell them to mind their own damn business as well. It's obvious anyway that the only thing Google cares about in this instance is making themselves look good at the expense of Microsoft.

> Then, they canned Chromium OS!

Chromium OS is alive and well. Perhaps you're thinking of the Chrome-specific "application" APIs, which have been deprecated in favor of web technologies?

Why shouldn't Google care about customers that use Windows? A large percentage of them also use Google services so it's in their interest to inform them.

>If I were Microsoft I'd tell them to mind their own damn business as well.

What would you tell their customers that were infected by their negligence? Let me guess? "Mind your own damn business".

I'm sure Microsoft has a bug-bounty. Google looks for bugs in competitors software and then blackmails the developers with disclosure, irregardless of that bug bounty. That isn't white-hat at all.

Bug bounties are usually for unexploited vulnerabilities that you find yourself. It sounds to me like google didn't discover this vulnerability on their own, they discovered malware that was exploiting it. I'm not sure if a bug bounty would pay out for a vulnerability you didn't discover.

Some comments feel almost troll

Maybe after the ridiculous Scroogled campaign that Microsoft did against Google, and stealing Google's search results, and extorting money from Android OEMs for lame patents, Google has earned the right to bully Microsoft a little. I'm okay with this.

No, they did what any security researcher would do, Google or not. To be honest, their call is a perfect one.

On the one hand, you don't tell anyone other than Microsoft and wait for them to patch as many people as possible while the bug is ACTIVELY being exploited and possibly thousands are getting hacked by the hour.

On the other hand, you tell people, and many are now able to patch it themselves RIGHT NOW, force an update on their machine, not use affected software, and potentially avoid a hack that would've happened if they didn't know.

So yes, it's not black and white, but I think their call of waiting a week was an okay one.

Reply on news.ycombinator.com