3 ms·

Downgrading the component to before the introduction of the flaw would be safer by far.

• dimino 10y ago
  That is an interesting idea, and on first blush I do think it'd be safer, but it does rely on figuring out exactly when the flaw was introduced, and will result in the "YoYoing" of features, which is confusing from a consumer standpoint.
  • 5ilv3r 10y ago
    POCs are a part of any good bug disclosure. It should be easy to test that one is no longer affected. Besides, trying older versions to undo problems is a very old and reliable technique.
    • dimino 10y ago
      I get that, but when you roll back, you don't really control what else you're removing, and you're implying that a roll back wouldn't break other parts of the system, or that it even makes sense, given the state of the system (it could be years before a vuln is noticed). Imagine waking up one morning and realizing you can't use uppercase on your file names anymore because of a rolled back vulnerability.