upvote
Project Zero will disclose vulnerabilities 90 days after reporting

(projectzero.google)

129 points

by hacb12 hours ago |
29 comments
upvoteby wewewedxfgdf13 minutes ago|
next
[-]
Ubuntu will need a LOT more time than that.
reply
upvoteby my-huge-pony6 hours ago|
prev|
next
[-]
Starting today, our policy is “Full 90”, i.e. vulnerabilities will be disclosed 90 days after they are reported to the vendor.

On February 2, 2027, we will move to a “Full 60” policy where vulnerabilities are disclosed after 60 days.

On January 3, 2028, we will move to a “Full 30” policy where vulnerabilities are disclosed after 30 days.

reply
upvoteby 2 hours ago|
parent|
next
[-]
deleted
reply
upvoteby ares6233 hours ago|
parent|
prev|
[-]
Perhaps eventually, they can finally live up to their namesake. On January 1 2029, we will move to a "Full 0" policy where vulnerabilities are disclosed after (looks at camera) zero days.
reply
upvoteby esafak3 hours ago|
parent|
[-]
If AI is doing all the work I could see that; same day remediation.
reply
upvoteby nextaccountic1 hours ago|
parent|
next
[-]
Which means developers must trust AI blindly since there is no time to review the fix. Which also means that developers are completely unneeded
reply
upvoteby perching_aix32 minutes ago|
parent|
next
[-]
No, that's not what it means. It just means that the benefit must outweigh the risk, as always. Making surgical patches to existing code is also quite different to introducing features, which is what developers typically spend their time on. Not that same-day patching would imply literally zero time to review either.
reply
upvoteby esafak1 hours ago|
parent|
prev|
[-]
That does not follow. Somebody stills needs to set it up. And maybe to sign off. The AI could instantly diagnose and summarize the problem and its remediation and you say the word.
reply
upvoteby jagged-chisel58 minutes ago|
parent|
next
[-]
And someone who understands the whole thing needs time to validate that the remediation is indeed what it's supposed to be.
reply
upvoteby TeMPOraL56 minutes ago|
parent|
[-]
No, they're not - they can just release and wait for another vulnerability disclosure. Then the loop between [Vendors] and Project Zero needs no humans in it.
reply
upvoteby vorticalbox35 minutes ago|
parent|
prev|
[-]
“Someone” being another AI agent.

It’s agents all the way down.

reply
upvoteby ares6233 hours ago|
parent|
prev|
[-]
If AI is doing all the work then why would remediation be needed at all? Why can't the software AI produces be vuln-free if the same AI is used to detect them?
reply
upvoteby IncreasePosts3 hours ago|
parent|
next
[-]
Because the people finding the vulns aren't the people running the services.
reply
upvoteby thwarted3 hours ago|
parent|
[-]
Why aren't they? The people running the services can use the AI to find the vulnerabilities before they release.
reply
upvoteby Catloafdev1 hours ago|
parent|
next
[-]
You talk as though there is one AI model that is perfect and capable of identifying all potential flaws with no mistakes or omissions, and that access is free and unlimited.

Reality is more complicated than that.

reply
upvoteby ares6233 hours ago|
parent|
prev|
[-]
Exactly. That's super irresponsible to knowingly release software that you haven't used AI to check if it had any vulns. There's zero (heh) excuse to release vulnerable software at that point.
reply
upvoteby canibalrex19 minutes ago|
parent|
[-]
Catching lots of bugs in software written with poor methodology is the new norm and that is not the same as releasing software that is not vulnerable. That is releasing software that needs increasing technological improvements or luck to find remaining vulnerabilities.
reply
upvoteby unsloppable3 hours ago|
parent|
prev|
[-]
Is the AI in the room with you right now?
reply
upvoteby TeMPOraL54 minutes ago|
parent|
[-]
The Machine is everywhere. Watching us with ten thousand eyes. Listening with a million ears.
reply
upvoteby level871 hours ago|
prev|
next
[-]
Unrelated, but didn't realise .google was a TLD.
reply
upvoteby DaSHacka1 hours ago|
parent|
next
[-]
Actually many brands pay for their own TLD, though most go unused (publicly).

https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...

reply
upvoteby mindwok1 hours ago|
parent|
prev|
next
[-]
There's lots of them now. Companies can apply to have their own for a few hundred thousand dollars.
reply
upvoteby varun_ch59 minutes ago|
parent|
prev|
[-]
so are .ads, .android, .cal, .chrome, .dclk, .docs, .drive, .gbiz, .gle, .gmail, .goog, .google, .guge, .hangout, .map, .meet, .play, .prod, .search,, .youtube, and .グーグル, .谷歌.

They are all owned by Google, but registrations are not open to the public.

reply
upvoteby jamiesonbecker3 hours ago|
prev|
next
[-]
[flagged]
reply
upvoteby Refreeze52242 hours ago|
parent|
[-]
Nice unsolicited plug for your slop product.
reply
upvoteby Frost1x2 hours ago|
prev|
[-]
I’m not familiar with this specific effort but it seems like the companies digging around for the bugs should also offer similar access to their products that discovered the vulnerabilities to the vendors or OSS projects to patch them. Otherwise vendors might use this as a leveraged approach to get people to adopt LLMs, specifically theirs, so their products remain reasonably attractive. Google, OpenAI, Anthropic etc could just turn on existing software as a strategy to get more adoption of their tools.

“Don’t like our constant stream of patches? For $10k/mo + tokens you can get access to the model to patch the vulnerabilities we disclose!”

reply
upvoteby sumeno1 hours ago|
parent|
next
[-]
The "product" that finds Project Zero bugs is the people who work for Project Zero.
reply
upvoteby Refreeze52242 hours ago|
parent|
prev|
next
[-]
Project Zero has been around far longer than GenAI or LLMs, so your point is not really relevant here.
reply
upvoteby Frost1x2 hours ago|
parent|
[-]
How is it irrelevant? Just because an effort existed before some change, doesn’t mean it can be repurposed and leveraged for other purposes. It’s the entire reason law and policy for government isn’t set in stone and is adaptable, because culture, technology and so on change.

The dynamic in this context absolutely has changed. Marginal cost to discover vulnerabilities from AI frontier labs and the big players has dropped significantly. The cost to patch is low, if you have access to certain resources. If you don’t, tough luck.

So this argument is essentially against the entire argument of AI alignment guardrails right now. Maybe you disagree with those, but I for one am happy they’re doing some things to protect against bio related warfare engineering. This is a case of cyber that’s about grey. Even there the labs have limited access to some and are choosing winners.

reply
upvoteby ylk1 hours ago|
parent|
prev|
next
[-]
Usually you can’t find the kind of bugs P0 finds by just throwing AI at it. You need highly skilled people driving/guiding it. Highly skilled people are the bottleneck.

In any case it’d be sensible to make yourself familiar with the “specific effort” before you make up your opinion on it.

reply
upvoteby clhodapp1 hours ago|
parent|
prev|
[-]
You say that like it's a bad thing...

I mean, sure, the cited $10k / mo is exploitative for small open-source projects but... in general, why wouldn't we want there to be pressure on companies and projects to use high-quality LLM-based checks if they want to see wide adoption?

reply