Google exposes Windows 11 security flaw after Microsoft fails to patch it

https://www.neowin.net/news/google-exposes-windows-11-security-flaw-after-microsoft-fails-to-patch-it-properly/

by UsamaJawad96 • 7 months ago

39 19 7 months ago

It seems lately every piece of software is getting more and more vulnerabilities, failures, crashes. Microsoft products are exceptionally high in the list.

hsbauauvhabzb4• 7 months ago

More people are looking. Microsoft products have been large attack surface, poorly coded and heavily researched for a very long time.

nly2• 7 months ago

I don't understand why they wouldn't give a pre-release patch to the bug reporter (especially if it's someone like Google) for them to analyse before doing a final release.

If they were actively working with Project Zero instead of being seemingly silent, this wouldn't happen

This is where FOSS is still winning and will always win. Fixed happen in the open and bad fixes can be called out

hsbauauvhabzb4• 7 months ago

I’m not sure why you think it’s the researchers responsibility to verify patches. It would be nice, especially if they’re knowledgeable in the code, but Microsoft have the resources to put someone else in that position too.

nly2• 7 months ago

The researchers in this case literally checked the patch after release. It costs nothing to send them a pre-release and ask the question

nwellnhof• 7 months ago

It should be noted that Google Project Zero doesn't care whether a software product is maintained by multi-trillion corporations or a single volunteer. Imposing an "industry-standard" 90-day deadline on a unpaid solo developer without offering any help or compensation whatsoever is not sustainable. It forced me to step down as maintainer of libxslt: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127

transpute• 7 months ago

What do you think of https://bughunters.google.com/open-source-security/patch-rew...?

philipallstar2• 7 months ago

The linked conversation looked pretty civil - looks as though you decided to step down, which is entirely reasonable, but I don't see anything forcing you or imposing anything on you.

ThunderSizzle2• 7 months ago

Civil, but unreasonable. An unpaid maintainer of a free library isn't a vendor, and shouldn't be treated in any such way. A vendor is paid.

Jiro• 7 months ago

You said "Being an unpaid volunteer, I also don't really care about external deadlines. I'll just make the issue and the fix public and people can patch libxslt themselves." But that's what they were going to do anyway if you didn't fix it--they were going to make the issue public. What's the problem?

hnburnsy• 7 months ago

Google is a bunch of hypocrites, there are other cases where Google asked third parties for a disclosure extension and the fixes took longer than 90 days, but here is the most recent one I noticed...

https://news.ycombinator.com/item?id=43032464

hsbauauvhabzb4• 7 months ago

What’s the expectation for responsible disclosure when it comes to ineffective patches? Does that normally reset the counter to 90 days, or only if the patch was reasonable and in good faith?

q3k• 7 months ago

Here's the actual issue with technical details instead of useless blogspam: https://project-zero.issues.chromium.org/issues/437291456

steve1977• 7 months ago

Microsoft, why don't you simply use Copilot to fix the vulnerability?

Google exposes Windows 11 security flaw after Microsoft fails to patch it

Related Stories