Hacker News Reader

Comment by WestCoastJustin | Hacker News Reader

TL;DR -- Google found bug in Windows 8.1. Gave Microsoft standard 90 days notice of public release on 11 January. Microsoft wanted to move release date to patch Tuesday on 13 January. Google released on their 90 day notice date of 11 January.

Personally, I don't think Google should bend to the internal red tape of other companies. You are going to start maintaining this long list of exceptions based on other peoples priorities. There is a published 90 day policy, they gave 90 days notice, figure it out. There is also details missing about the communication between Google and Microsoft. Like when they asked for an extension, etc.

View on HN

If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

If you start making exceptions, everyone will want one.

When you are the largest provider of the worlds desktop OS, you get exceptions.

Apparently not.

You shouldn't. The world's largest OS supplier should have the manpower to fix bugs in a timely fashion.

Well, they thought so too. And it turned not to be true. And now they're blaming the others.

It's the opposite of bureaucracy. Strict simple rule cuts the bureaucracy off.

If you don't have it, then you have a lot of time wasted on communication, handling special exceptions, making decisions if you should bend it or not and so on.

> If there can't be any common sense exceptions to the 90-day policy, that's just bureaucracy by itself.

Its worth noting, as pointed out upthread, that the only reason it was released in January at all was because when Microsoft asked if their planned February release was going to cause a problem with the 90-day deadline, Google informed them the the 90-day deadline for that bug was 11 January and that that's when disclosure would occur. Clearly, the fixed deadline already achieved part of what it was intended to -- encouraging vendors to fix security issues more quickly.

And I'm not sure that there even exists such a thing as a "common sense exception" to that policy, but extending it simply to accommodate a vendor schedule that delays releases of security fixes to predetermined dates isn't such a common sense exception even if any exist. Its simply favoring the bureaucracy of fixed patch schedules over the purpose of the disclosure policy, which is encouraging vendors to more timely release fixes for security bugs.

Google is all about 'the algorithm' - it's organizational DNA.

It's not about bending to another company's internal policy. It's about having etiquette for the company patching the vulnerability that extends beyond the basic rules; especially when it could harm users. What Google did certainly stayed within normal policy, but that doesn't make it good form.

Here's an idea. Knowing Redmond's schedule, could they have notified them but set the disclosure date 2 days ahead? That seems like professional courtesy.

Zero tolerance policies are never a good idea, there's always some exception that seems far fetched until it actually happens that proves this.

I wonder how many Android devices out there are missing security updates.

None that Google can update.

Engineers love zero tolerance policies, but that doesn't mean they are the best choice in every situation. A little wiggle room doesn't end the world.

The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness.

You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...

Reply on news.ycombinator.com