There’s a cat fight happening between Google and Microsoft. Basically, Google has a policy to publicly disclose any bugs it finds within 90 days of informing the software provider. In this case, it was a bug in Windows that allowed a person’s system to be taken over. It’s not easy to do, but possible nevertheless.

The 90 window passed with still no fix from Microsoft, so Google went ahead and published the bug for all hackers to learn. Microsoft did issue a fix just two days after Google went public, and obviously isn’t happy with Google. As a Microsoft representative wrote:

Although following through keeps to Google’s announced timeline for disclosure, the decision feels less like principles and more like a “gotcha”, with customers the ones who may suffer as a result. . .What’s right for Google is not always right for customers. We urge Google to make protection of customers our collective primary goal.”

So who’s right, who’s wrong?

Google deserves kudos for finding the bug. Their 90 day policy is in place to put pressure on software makers to issue fixes, which is always a good thing for consumers. Without that pressure, software makers may never get around to fixing bugs. So consistent enforcement is necessary to give the policy teeth.

Making an exception for Microsoft could lead to many more exceptions in the future; it’s a slippery slope. The bug is Microsoft’s responsibility and it’s their responsibility to fix it as soon as they can.

However, having been in the business of software development for a few years, I can empathize. There will always be bugs, especially in a product as complex as Windows.

Moreover, not all bugs are created equal. Some really can take more than 90 days to properly fix. We’ve found bad bugs before that required a larger re-architecting. Yes, it’s our fault re-architecting was even needed in the first place, but those are problems every software developer has. Software, like Rome, isn’t built in a day, and sometimes buildings have to be torn down to make things better.

This was likely the case for the Windows bug. Microsoft didn’t decide to fix the bug just because Google went public; most likely, they started working on it early and just couldn’t get it done in 90 days.

It’s a tough call. Google needs to enforce standards, otherwise, by default none exist. Yet, those standards are not always fair or realistic.

If I was Google I’d probably have given Microsoft the extra two days though.

After all, Google too has annoying bugs that they haven’t fixed in years. Like this one.

Update (Jan 15, 2014): Or this serious one, which affects over 60% of Android users and remains unfixed.