[forapurpose]

What is the story with Project Zero? What is the strategy here?

If you think about it, pointing out flaws in competitors' products is actually unusual for businesses, especially large ones. It raises questions of motives, of trust (are they drumming up business in a negative way? Can I trust what company X says about their chief rival? Are they exaggerating or spinning it?), and it looks unsavory: You don't win in the court of public opinion by insulting the competition, right or wrong; you just look like a jerk. Also, there's a liability risk, which adds legal costs to otherwise free blog posts - 'can't you guys just find Linux bugs?'.

On the other hand, it might improve security for everyone if Apple and Google started competing to publicize each other's flaws. :) (But I'd bet the noise of accusations and counter-accusations of errors in analysis, misleading statements, etc. would soon drown out the technical info, and then the lawsuits would begin ...).

[veeti]

Project Zero doesn't discriminate:

https://googleprojectzero.blogspot.fi/2017/07/trust-issues-e...

https://googleprojectzero.blogspot.fi/2015/09/stagefrightene...

https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

[late2part]

I submit for your consideration that:

1. The Google Project Zero guys are idealists and motivated by increasing security.

2. Google security is taken far more seriously than most other companies

3. If Apple and Google competed in publicizing exploits, Google would win [is winning].

[advisedwang]

If everyone competed in publicizing exploits and like project zero coordinates disclosure with vendors, then _consumers_ win!

[burnte]

QUalcomm and Linux aren't competetitors, and while MS and Apple are, the PZ blog has talked about them all. It's a very technical security blog.

[pgeorgi]

> It raises questions of motives

I don't think Project Zero ever analyzed something that isn't used at Google (for example with the Apple stuff: somebody at Google has to build the Google iOS apps). Wanting to know what's going on on the corporate network is the job of a corporation's IT security unit.

The publications serve to force vendors to fix their mess. Microsoft already complained that the 90 days limit by Project Zero is unfair (and got a 14 days-to-next-patchday extension). And there are other experiences from researchers adhering to "responsible disclosure" schemes where the vendor only became active once publication was a real threat.