3 ms·

They actually have a 14-day grace period now, but only if the vendor says it has a patch that's almost ready to go (and can be deployed within that 14-day perio

by mtgx 10y ago

They actually have a 14-day grace period now, but only if the vendor says it has a patch that's almost ready to go (and can be deployed within that 14-day period). So I guess Microsoft missed both of those deadlines.

dpark 10y ago
> So I guess Microsoft missed both of those deadlines. No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was no additional 14-day period (for whatever reason).
- scarybeast 10y ago
  There is always an additional 14-day period on offer, but the vendor has to choose to use it, and has to actually land the patch within the 14 extra days. So, a deadline miss is often really a 104 (!!) day deadline miss. As an industry that's trying to refocus on security, surely we can do better than that.
- actuator 10y ago
  I think OP meant that Microsoft missed the deadline by not even having the fix ready that would have earned them the 14 day grace period.
  - Heliosmaster 10y ago
    or they did not communicate anything to P0
- qeternity 10y ago
  The grace period isn't automatic, otherwise that would just be a 104 day window. The grace period applies when the vendor has been in communication with P0 that a patch is in the works and will be released within 2 weeks of the end of the 90 day window. Presumably that didn't happen here.
  - dpark 10y ago
    I wasn't proposing that it was automatic. "For whatever reason" means just that. I wasn't making any statement about why there was no additional 14-day window.
rbanffy 10y ago
Suppose you need 30 days to very thoroughly test your patches before making them generally available. This still leaves 60 days for fixing the actual bug. It really seems ample time.
- notyourwork 10y ago
  Or at the very least acknowledge and work with the reporting entity to delay disclosure or come to an agreement on how you plan to resolve. 90 days is plenty of time to get your ducks in a row.

by mtgx 10y ago

dpark 10y ago

> So I guess Microsoft missed both of those deadlines. No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was no additional 14-day period (for whatever reason).

scarybeast 10y ago
There is always an additional 14-day period on offer, but the vendor has to choose to use it, and has to actually land the patch within the 14 extra days. So, a deadline miss is often really a 104 (!!) day deadline miss. As an industry that's trying to refocus on security, surely we can do better than that.
actuator 10y ago
I think OP meant that Microsoft missed the deadline by not even having the fix ready that would have earned them the 14 day grace period.
- Heliosmaster 10y ago
  or they did not communicate anything to P0
qeternity 10y ago
The grace period isn't automatic, otherwise that would just be a 104 day window. The grace period applies when the vendor has been in communication with P0 that a patch is in the works and will be released within 2 weeks of the end of the 90 day window. Presumably that didn't happen here.
- dpark 10y ago
  I wasn't proposing that it was automatic. "For whatever reason" means just that. I wasn't making any statement about why there was no additional 14-day window.

rbanffy 10y ago

Suppose you need 30 days to very thoroughly test your patches before making them generally available. This still leaves 60 days for fixing the actual bug. It really seems ample time.

notyourwork 10y ago
Or at the very least acknowledge and work with the reporting entity to delay disclosure or come to an agreement on how you plan to resolve. 90 days is plenty of time to get your ducks in a row.