Google engineer bashes Microsoft's handling of security researchers, discloses Windows zero-day
Microsoft confirms probe of vulnerability hackers could use to gain additional privileges on targeted PCs — A Google security engineer accused Microsoft of treating outside researchers with …
Context & Ripple Effects
The disclosure lands on awkward ground for Microsoft: back in August 2011 the company was quietly finding and reporting holes in rivals' products, including Google's own software, casting itself as a responsible finder of flaws. A Google engineer now flips that script, publicly accusing Microsoft of mistreating outside researchers before dropping an unpatched Windows privilege-escalation zero-day.
Microsoft has confirmed it is investigating the flaw, which attackers could use to gain elevated privileges on targeted PCs. The story drew same-day pickup from The Verge, signaling that the researcher-relations spat — not just the bug itself — is what the press finds newsworthy.
First-order effects
- Windows users face an unpatched privilege-escalation vector while Microsoft investigates, with no fix available at disclosure time.
- Microsoft's security response team is now handling both the technical triage and a public relations problem over how it treats external researchers.
Second-order effects
- Other vendors' coordinated-disclosure practices come under scrutiny by comparison, since the accusation targets process rather than any single bug.
- Google and Microsoft's security relationship sours, complicating the cross-vendor bug reporting each had extended to the other's products as recently as 2011.
Third-order effects
- If engineers keep bypassing vendor channels to force fixes, pressure builds toward standardized disclosure deadlines and formal policies replacing ad-hoc researcher-vendor negotiation.
The trend: Security research is shifting from quiet private coordination toward public leverage, with individual researchers and vendors using disclosure itself as a bargaining tool.