<story><title>Google reveals fistful of flaws in Apple&apos;s iMessage app</title><url>https://www.bbc.co.uk/news/technology-49165946</url></story><parent_chain><item><author>ziddoap</author><text>It seems like peoples hatred for Google is leaking over to how they think vulnerability disclosures should happen.&lt;p&gt;Reading through the comments is disorientating - people are angry that researchers are.. &lt;i&gt;gasp&lt;/i&gt;... researching vulnerabilities. It&amp;#x27;s not some faceless Google Incarnate monstrosity, they are paid researchers (humans, too!). If it was Cure53 that did this, for free, and made the exact same announcement no one would bat an eye.&lt;p&gt;Good on &lt;i&gt;whatever&lt;/i&gt; company does vulnerability research, follows established protocols in disclosure, and makes the world a safer place.</text></item></parent_chain><comment><author>tptacek</author><text>When I read these comments I also feel like people must believe P0 is some kind of new thing that Google came up with. In fact, vulnerability research labs have been A Thing in the security field since the mid-1990s (I worked at what I believe to be the first commercial vulnerability lab, at Secure Networks, from &amp;#x27;96-&amp;#x27;98, along with much smarter people like Tim Newsham and Ivan Arce). And they&amp;#x27;ve always been taking this kind of (dumb) flak regardless of which company they&amp;#x27;re attached to.&lt;p&gt;If companies like Apple or Microsoft are alarmed by the optics of Project Zero, they are free to stand up their own vulnerability research labs; they have the resources and they would immediately find takers in the research community.&lt;p&gt;End-users, meanwhile, should have nothing but gratitude for P0, since that project essentially represents Google donating fairly expensive and scarce specialized resources to public interest work. Vulnerabilities that P0 finds are vulnerabilities that aren&amp;#x27;t being sold through brokers to the global intelligence community. Message board talk about the &amp;quot;black market&amp;quot; alternative to bug bounties is almost always overblown, but P0 traffics in &lt;i&gt;exactly&lt;/i&gt; the small subset of vulnerabilities that do have substantial, liquid markets.</text></comment>
<story><title>Google reveals fistful of flaws in Apple&apos;s iMessage app</title><url>https://www.bbc.co.uk/news/technology-49165946</url></story><parent_chain><item><author>ziddoap</author><text>It seems like peoples hatred for Google is leaking over to how they think vulnerability disclosures should happen.&lt;p&gt;Reading through the comments is disorientating - people are angry that researchers are.. &lt;i&gt;gasp&lt;/i&gt;... researching vulnerabilities. It&amp;#x27;s not some faceless Google Incarnate monstrosity, they are paid researchers (humans, too!). If it was Cure53 that did this, for free, and made the exact same announcement no one would bat an eye.&lt;p&gt;Good on &lt;i&gt;whatever&lt;/i&gt; company does vulnerability research, follows established protocols in disclosure, and makes the world a safer place.</text></item></parent_chain><comment><author>nova22033</author><text>People are complaining about quality security research...on hacker news!!</text></comment>