So Google put up a blog post a couple days ago that I cant stop thinking about. They're calling it Project Zero, and the short version is: they've hired a small team of security researchers whose entire job is to find zero-day vulnerabilities. Not just in Google's own stuff either. Anything. Windows, OS X, whatever browser you're using right now, the router sitting under your desk collecting dust.
The name people already recognize from that post is Tavis Ormandy, who's been finding nasty bugs in other companies' code for years and occasionally making those companies very uncomfortable in the process. Now he's got official backing and (presumably) a nicer expense account to do it full time.
Heres why this actually lands for me instead of just being another "Google Does Thing" post. Remember April? Heartbleed? I spent an entire Saturday that month rotating passwords for accounts I hadn't logged into since 2009, because some bug had apparently been sitting in OpenSSL for two years before anyone noticed it. Two years. That's not a rounding error, thats an entire pop-punk revival cycle. The bug was hiding in code that half the internet depended on, and it took this long for somebody to trip over it.
That's the actual pitch behind Project Zero as I read it: too much of the internet's plumbing is maintained by a handful of tired volunteers or under-resourced teams, and the bad guys (state-sponsored or otherwise) have every incentive to go find these holes first and sit on them quietly instead of reporting them. If a company with Google's money decides to go looking on purpose, before the bad guys do, and publishes what they find with a disclosure deadline attached, that's a meaningfully different incentive structure than what we've had.
I'll admit part of me is a little cynical about it too. Its good PR, obviously. And there's something a bit uncomfortable about one company deciding it gets to audit the security of software it doesn't own, on its own timeline, whether the vendor likes it or not. Ive read a few comment threads already where people are worried this turns into Google strong-arming smaller companies with 90-day disclosure clocks they cant realistically meet. That's a fair worry. I dont think it cancels out the good the team will probably do, but I'm not going to pretend it's pure altruism either. Companies dont staff up security research teams out of the goodness of their hearts, they do it because the Heartbleeds and Shellshocks (not a thing yet as I write this, but you get the idea) of the world cost real money and real trust.
Unrelated tangent, but on the same day this Project Zero post went up, Microsoft announced something like 18,000 job cuts, a huge chunk of it hitting the old Nokia devices team they bought back in April. I had a Nokia phone as a teenager, one of the indestructible ones, and there's something genuinely sad about watching that whole operation get carved down this fast. Different story, not going to try to connect it to security research with some clever transition, it just happened the same week and it's been sitting in the back of my head all day.
Anyway. If you run any kind of server, even a dinky little VPS hosting a WordPress blog nobody reads, now's as good a time as any to go check what version of OpenSSL you're on and whether your auto-updates are actually running. I say this as someone who found out the hard way in April that mine werent.