3 ms·
I think the person making that comment is confused about how this works. The bug was filed in November. The deadline passed before the comment was made.
by obstinate 10y ago
I think the person making that comment is confused about how this works. The bug was filed in November. The deadline passed before the comment was made.
- rattray 10y agoThe "Deadline exceeded -- automatically derestricting" comment was posted on Feb 23, 90 days[0] after Nov 25. The account that posted it, hawkes@google.com, is listed[1] as the "owner" of Project Zero, which implies to me that they may be a user account, but quite likely one that has a script running under its permissions. There certainly could be a human-controlled kill-switch to this release process, of course, and it's possible that "hawkes" manually goes through a list of vulnerabilities every day and clicks "release". [0] http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 [1] https://bugs.chromium.org/u/1279493906/ https://bugs.chromium.org/u/1279493906/
- btilly 10y agoWhich person making which comment? The one who didn't expect it to miss the deadline is the same as the person who originally reported the vulnerability. It is therefore a safe assumption that this person understands the disclosure process involved. Furthermore it is a safe bet that the bug is exploitable. I'm sure that the black market will shortly have people using it.
- obstinate 10y agoOops. I misread "(I really didn't expect this one to miss the deadline)" as "I really don't expect . . ." in #5.