Hacker News Reader

Comment by Someone1234 | Hacker News Reader

I'd argue that Epic is irresponsible for putting users into this position to start with. All Google did was tell users that they need to update ASAP as they're ALREADY in a compromised position.

If there was no update/patch, I might side with Epic, but as soon as the fix was out and everyone needed to update, users needed to know the risks of inaction would inhibit. Not least of all because people may start reverse engineering the patch.

Epic has decided this is revenge for them not using Google Play, but if you look at Google's bug efforts historically, this has always been how they handled these issues. They've been highly consistent about it.

If Epic wants to keep serious security bugs under wraps in the future, maybe they shouldn't rely on unpaid third parties to audit their code.

PS - Google gave them 7 days from patch release, so most auto-updaters likely updated the installer.

View on HN

They're both in the wrong. Epic for screwing it up and rushing rather than investing in security, and Google for trying to score PR points at the expense of their users. Google is being anti-secure here by not allowing the update to filter through the ecosystem.

> Google for trying to score PR points at the expense of their users.

Except this is how Google has always handled these bugs. The article even links to other examples involving other companies.

> Google is being anti-secure here by not allowing the update to filter through the ecosystem.

Or pro-secure here by telling users to urgently update rather than doing nothing and hoping nobody spots the bug and starts exploiting it before users get lucky.

Well, it's not that there is nothing being done. You're distributing the patch.

You don't have to go yelling about the fact you're distributing a highly important security patch, that only draws the attention of the bad guys.

Wanting to distribute such patches as low profile is a valid choice and is not "doing nothing and waiting to people to exploit it".

If you are a hacker it is not improbable that you are keeping tabs on updates for high profile software like Fortnight. In that case, doing things "low-profike" gives bad actors an edge.

Even if you keep tabs on it, would you inspect every single update that comes out or would you rather inspect the ones labelled "security updates"?

Low-profile means what it says on the tin; make it sound so boring that hackers are less likely to attempt it.

Plus being low profile reduces exposure to people who only look for high profile stuff.

And plus "not improbable" =!= "fact".

Google is punishing Epic for communicating. Had Epic silently released the patch and not responded to the thread they could have gotten more time to patch. That doesn’t bode well for future security issues.

If Epic had silently released the patch and not responded to the thread, that would be irresponsible and unethical, be harming the security of their users and be spitting in the face of the responsible disclosure community - that's something that you can do once, demonstrating to the world that they explicitly refuse responsible disclosure and every security researcher should publish Epic's vulnerabilities immediately without notifying Epic first.

And it's not like they would have succeeded - you can't patch something silently, if you know of a vulnerability it's not that hard to verify if it has been fixed in every upcoming version or not. Google would have had noticed that within a day anyway and (with justification) disclosed the vulnerability right then and there, instead of giving them those 7 extra days.

Reply on news.ycombinator.com