7 ms·

Am I reading this right? Google engineers are fixing apple software?

olliej 5y ago
You aren’t reading it right :) Although there’s clearly bugs in the open source JBIG2 impl so someone probably made fixes there as well?
SamuelAdams 5y ago
Project Zero is a team of security analysts employed by Google tasked with finding zero-day vulnerabilities. https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 Don’t think of these folks as “google” employees. Think of them as “really good hackers with corporate sponsorship”. They look for flaws in everything - windows, apple, Linux, and google software. You should read some earlier blog posts, they’re really high quality.
- ushakov 5y ago
  how does Google benefit from this?
  - RandallBrown 5y ago
    Google makes money when people use the Internet. By making it safer to use the Internet, more people will use it and Google will make more money.
  - derwiki 5y ago
    We’re talking about them right now
    - ushakov 5y ago
      they’re still evil though?
  - hn_throwaway_99 5y ago
    A large percentage of the planet has personal sensitive data stored by Google. If that data leaks, even due to a bug in another company's product through which Google has no fault, Google suffers. Google greatly benefits by having a secure Internet.
    - netizen-936824 5y ago
      On this note, has google ever had a breach? I actually can't think of one off the top of my head, which is impressive for a company like google with so much data and such a large footprint Either their security or PR is great (or both?)
      - sophacles 5y ago
        There was this one: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora It seems that the level of access gained could have been used for a larger breach but fortunately the attackers had different motives.
        robocat 5y ago
        Google banned Windows throughout the organisation in 2010 due to this (with some well fenced exceptions where Windows was unavoidable). 1. Google will do costly things to be secure. 2. At the time I did not hear of any other organisation following Google’s lead. 3. They did not reverse the ban later.
        deleted 5y ago
        [deleted]
        joshuamorton 5y ago
        Also, iirc P0 was created as a result of that breach.
      - rodgerd 5y ago
        > has google ever had a breach? They've been completely breached by Chinese agencies in the past, and IIRC the revelations in the Snowden leaks prompted them to redo their entire internal networking layout because of concerns about state-level spying. On the Android front they keep tightening up access (removing more power from root, more use of SELinux and other controls) because of breaches in one form or another.
  - exikyut 5y ago
    Windows/macOS/Linux aren't the operating system any more, the browser is. And the browser's job is to be constantly online the whole time and download and execute JavaScript that gets dynamically optimized for your CPU architecture using one of the fastest runtime compilers ever made (aNd WhiCh MiGhT HaVe BuGs iN iT), and then your CPU directly, blindly executes the result, with as little bounds-checking as the runtime compiler thinks it can get away with so it runs as fast as possible. Zooming out somewhat, the new OS paradigm is the continuous download and execution of absolutely arbitrary code, all day, every day, from sources including hacked ad servers, successful social engineering campaigns and your blog. And Chrome has like ~70% market share. Because public company and "legally bound to create value for shareholders" and all that, it is very much in Google's interest that they maintain that market share because that lets them serve more ads. So that's ultimately the reason. Google wants the world's most secure platform so they can guarantee their ads business.
  - codezero 5y ago
    Google employs a lot of people using Apple hardware.
  - rodgerd 5y ago
    The NSO are as much Google's enemy as Apple's.
  - Juliate 5y ago
    Among others, what jumps to me: more stability on the network and terminals (better for their business), goodwill, attracting talent.
  - rwaksmunski 5y ago
    They are very often on the receiving end of state level shenanigans. Finding bugs in software they use, helps them stay secure. Not to mention the goodwill earned.
vmception 5y ago
yes, you are, and this isnt abnormal or require some form of temporary altruism. google is incentivized by ad space, not hardware sales. a large portion of the users of google apps and search engine are using apple hardware.
Jerry2 5y ago
> Google engineers are fixing apple software? In this case, this was already fixed by Apple's engineers. And like the article says, Citizen Lab (people who captured the exploit in the wild) and Apple have shared the exploit with Project Zero who analyzed it as well and wrote up that blog post. Project Zero people have found numerous bugs in Apple's software in the past. They look at all kinds of software that's written by all vendors.

You aren’t reading it right :) Although there’s clearly bugs in the open source JBIG2 impl so someone probably made fixes there as well?

SamuelAdams 5y ago

Project Zero is a team of security analysts employed by Google tasked with finding zero-day vulnerabilities. https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 https://en.wikipedia.org/wiki/Project_Zero?wprov=sfti1 Don’t think of these folks as “google” employees. Think of them as “really good hackers with corporate sponsorship”. They look for flaws in everything - windows, apple, Linux, and google software. You should read some earlier blog posts, they’re really high quality.

ushakov 5y ago
how does Google benefit from this?
- RandallBrown 5y ago
  Google makes money when people use the Internet. By making it safer to use the Internet, more people will use it and Google will make more money.
- derwiki 5y ago
  We’re talking about them right now
  - ushakov 5y ago
    they’re still evil though?
- hn_throwaway_99 5y ago
  A large percentage of the planet has personal sensitive data stored by Google. If that data leaks, even due to a bug in another company's product through which Google has no fault, Google suffers. Google greatly benefits by having a secure Internet.
  - netizen-936824 5y ago
    On this note, has google ever had a breach? I actually can't think of one off the top of my head, which is impressive for a company like google with so much data and such a large footprint Either their security or PR is great (or both?)
    - sophacles 5y ago
      There was this one: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora It seems that the level of access gained could have been used for a larger breach but fortunately the attackers had different motives.
      - robocat 5y ago
        Google banned Windows throughout the organisation in 2010 due to this (with some well fenced exceptions where Windows was unavoidable). 1. Google will do costly things to be secure. 2. At the time I did not hear of any other organisation following Google’s lead. 3. They did not reverse the ban later.
        deleted 5y ago
        [deleted]
        joshuamorton 5y ago
        Also, iirc P0 was created as a result of that breach.
    - rodgerd 5y ago
      > has google ever had a breach? They've been completely breached by Chinese agencies in the past, and IIRC the revelations in the Snowden leaks prompted them to redo their entire internal networking layout because of concerns about state-level spying. On the Android front they keep tightening up access (removing more power from root, more use of SELinux and other controls) because of breaches in one form or another.
- exikyut 5y ago
  Windows/macOS/Linux aren't the operating system any more, the browser is. And the browser's job is to be constantly online the whole time and download and execute JavaScript that gets dynamically optimized for your CPU architecture using one of the fastest runtime compilers ever made (aNd WhiCh MiGhT HaVe BuGs iN iT), and then your CPU directly, blindly executes the result, with as little bounds-checking as the runtime compiler thinks it can get away with so it runs as fast as possible. Zooming out somewhat, the new OS paradigm is the continuous download and execution of absolutely arbitrary code, all day, every day, from sources including hacked ad servers, successful social engineering campaigns and your blog. And Chrome has like ~70% market share. Because public company and "legally bound to create value for shareholders" and all that, it is very much in Google's interest that they maintain that market share because that lets them serve more ads. So that's ultimately the reason. Google wants the world's most secure platform so they can guarantee their ads business.
- codezero 5y ago
  Google employs a lot of people using Apple hardware.
- rodgerd 5y ago
  The NSO are as much Google's enemy as Apple's.
- Juliate 5y ago
  Among others, what jumps to me: more stability on the network and terminals (better for their business), goodwill, attracting talent.
- rwaksmunski 5y ago
  They are very often on the receiving end of state level shenanigans. Finding bugs in software they use, helps them stay secure. Not to mention the goodwill earned.

vmception 5y ago

yes, you are, and this isnt abnormal or require some form of temporary altruism. google is incentivized by ad space, not hardware sales. a large portion of the users of google apps and search engine are using apple hardware.

Jerry2 5y ago

> Google engineers are fixing apple software? In this case, this was already fixed by Apple's engineers. And like the article says, Citizen Lab (people who captured the exploit in the wild) and Apple have shared the exploit with Project Zero who analyzed it as well and wrote up that blog post. Project Zero people have found numerous bugs in Apple's software in the past. They look at all kinds of software that's written by all vendors.