Hacker News new | ask | show | jobs
by rocqua 218 days ago
This was not a case of stumbling across a bug. This was dedicated security research taking days if not weeks of high paid employees to find.

And after all that, they just drop an issue, instead of spending a little extra time on producing a patch.
1 comments
walletdrainer 217 days ago
It’s possible that this is a more efficient use of their time when it comes to open source security as a whole, most projects do not have a problem with reports like this.

If not pumping out patches allows them to get more security issues fixed, that’s fine!

link
rocqua 217 days ago
From the perspective of Google maybe, but from the perspective of open source projects, how much does this drain them?

Making open source code more secure and at the same time less prevalent seems like a net loss for society. And if those researchers could spare some time to write patches for open source projects, that might benefit society more than dropping disclosure deadlines on volunteers.

link
walletdrainer 217 days ago
I’m specifically talking from the perspective of everybody but Google.

High quality bug reports like this are very good for open source projects.

link