Google Fixes IE Bug 225
aussie_a writes "Without accepting blame Google has quickly patched the vulnerability, without requiring users to download a patch. Previously covered by Slashdot, the flaw allowed people to access files and passwords on a computer via any website when viewed with IE while running Google Desktop." From the article: "'Google was able to address the problem quickly because it didn't require changing any code at the user's desktop,' MacDonald said. 'Google applied more stringent security controls on its main site, which shut down the exploit.' The incident does raise important questions about Google as a desktop software vendor and its plans for rolling out future security fixes, said MacDonald. "
Thanks for Fixing the Problem (Score:4, Insightful)
I don't care who's fault it is. Just fix the problem.
If they can fix stuff at their end... that's cool! (Score:5, Insightful)
"Raises questions"? (Score:5, Insightful)
Yay! (Score:1, Insightful)
Without Accepting Blame? (Score:1, Insightful)
The root problem is in IE. They made a work-around for their software. Why should they accept blame?
Re:The bug was Google's... (Score:3, Insightful)
Actually, the bug IS originally in the IE code. But Google's Desktop implementation of that code failed to address the security hole. In other words: Microsoft created the security hole and Google Desktop made it dangerous. Who's to blame? MS? Google? Both? None? You decide.
Re:The bug was Google's... (Score:4, Insightful)
What standards would those be? (Score:5, Insightful)
From CIO Today: The incident does raise important questions about Google as a desktop software vendor and its plans for rolling out future security fixes, said MacDonald.
"Since Google is providing end-user software, it must be held to the same standards that you would hold other desktop software vendors to," he said.
Standards? What standards would those be? Last I checked, most software manufacturers are sending out buggy copies of their code hoping you won't notice, patching it up continuously, then going ahead and doing it repeatedly. And let's not forget that Microsoft is the king of them all!
And exactly how are we to hold them to these "standards"? So many people use Microsoft routinely that they have the lion's share of the market, and their competitors are left with the spoils. And while you may not like MS, many of their programs work just well enough that you believe you've got a decent, everday product. Of course they break down, and people scream and rant, but in the end what do they do? Do they immediately switch to something else? No! They patch up their flawed software and keep the status quo.
It's a classic case of addiction, a lot like gambling but in reverse. You use the software every day and most days it works. The one time it doesn't, you fret, but because you restart it or patch it and it works, you go right back to it, rather than exploring alternatives. And Microsoft counts on this. That's why they dominate - they have everybody "addicted" to their software.
Responsibilty. (Score:5, Insightful)
Nope. Object-orientated programming. If the api documentation says that something should operate in a certain way and it does not then by fixing the problem on your side of things it weakens encapsulation of the function and makes it easier for future bugs to accumulate as the totality of code slowly turns to spaghetti.
Re:The bug was Google's... (Score:3, Insightful)
Re:Ok everyone.... (Score:3, Insightful)
Google, of all organisations, should know better than to trust IE for anything.
Would it be so hard for them to include a safer rendering engine? Gecko's good. KHTML's good. Both are free. Couldn't they have used those instead? Then if there were any bugs discovered, Google (having the source code) could fix 'em, rather than having to implement some workaround because Microsoft won't.
Re:Ok everyone.... (Score:3, Insightful)
Whats the deal? (Score:1, Insightful)
These bugs should be fix according to their priority.
Google provides some software.
Google should fix it's bugs according to their priority.
I'm not sure what this article wants to tell us? That even Google can create bugs? Is this a surprise? Is Google special that this is actually worth to mention?
Why would a bug created by Google any better or worse than a bug by any other software vendor? Of course the bugs should be fixed and apparently Google did it. So this article tells us that a security flaw has been fixed for some special case, because apparently it can't fix it permanently unless it took over maintainence for IE.
Why this MacDonald guy needs a special plan for Google is beyond me though. Maybe somebody could enlighten me there.
An analogy for the comprehension-deficient... (Score:5, Insightful)
Jane's car has a faulty parking brake.
Dick parks, engages the brake, but the car rolls away.
Dick stops parking on hills.
Important Points
Jane did not fix the parking brake
Dick did not fix the parking brake, but he no longer uses it.
Other drivers may or may not be aware of the broken parking brake.
The potential is still there for the car to roll away.
Re:What standards would those be? (Score:1, Insightful)
Re:Misleading title (Score:3, Insightful)
I see. In that case, that's working around the bug, not fixing it. If I said "yesterday I was coding when I stumbled in a Glibc bug -- it took me a while but I fixed it" you'd probably infer that I actually went into Glibc's code and corrected the problem. I understand now how calling it a "Google Desktop bug" is not right either, but I still think "fixes IE bug" is misleading. Or I might be just too nit-picky.
Re:Responsibilty. (Score:3, Insightful)
Re:If they can fix stuff at their end... that's co (Score:3, Insightful)
Re:Sort of good they fixed it... (Score:3, Insightful)
The thing that needs to really be studied is the openness with which a vendor accpets that there is a flaw, and how quickly they solve said flaw.
Here, Google, whether partially, fully, or not at all at fault, has with expedience solved an issue that had the potential to affect their customers. Code is rarely free from bugs. An active developer base that is willing to drop all to solve a potentially dangerous bug is one I want writing my software.
Misleading Title (Score:4, Insightful)
The IE bug can still affect other software.
My reply on their site (Score:3, Insightful)
This article appears to be quite confused. In some way, it appears to point at google and claim somehow that the vulnerability was google's fault. Phrases like "Google Fixes Desktop Search Loophole" and "Since Google is providing end-user software, it must be held to the same standards that you would hold other desktop software vendors to" strongly imply this. In other parts the article is very explicit that the problem is an IE vulnerability that Microsoft hasn't patched.
So, which is it? Is google doing Microsoft a favor by avoiding the use of a feature that Microsoft flubbed? Or did google do something wrong in the first place? And precisely what standards are other makers of desktop software held to? The industry seems to almost gleefully accept an endless parade of the most egregious bugs from these vendors (Microsoft in particular). So, it seems that it would be meaningless to hold google to the same standard unless the complaint is that they have too few bugs.
Note that I have never worked for google or Microsoft.
Another annoyance is this sentence: "Does the researcher think he has really contributed to the security of Internet users worldwide by going public with details of the problem when no fix is available?" In the absence of any other data, that question can't be answered. If a vulnerability goes for longer than a month without the vendor fixing it, then I think a responsible security researcher has a duty to disclose the vulnerability so that people can protect themselves from it.
There is a fine balance to be struck. And as a rule, it is always a courtesy for a security research to disclose a vulnerability first to a vendor, and secondly to the net at large. It is never a requirement. If a vendor abuses the courtesy by not bothering to fix the bug, the researcher has every right (and indeed, a duty) to present the information to the public. You can be sure that people who are much more shadowy than the security researcher looking for a bit of acclaim have a good chance of already knowing about the bug, and are quietly exploiting it for themselves.
All in all, I find your article to be both too simplistic in its treatment of various issues, and confused and muddled about exactly where responsibility lies for various problems. You should be able to do better. You call yourselves 'CIO Today', and the average IT worker's biggest complaint about their bosses is how ill-informed their bosses are about technology while being absolutely certain that they know better than their employees. Perhaps this article points to the reason why.
Note that I have never worked for either Microsoft or google.
Re:Suggested title (Score:3, Insightful)
Ethical? (Re:Sort of good they fixed it...) (Score:3, Insightful)
I've been as much a Google fanboy as anyone--Gmail, Google search on my Web sites and built in to my Web browser, AdSense, Blogger. Except that Blogger, owned by Google, has deleted my account [slashdot.org] with no discussion and no appeal.
I think the "not evil" ethical standards may be slipping just a bit.