3 ms·
> So I guess Microsoft missed both of those deadlines. No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was n
by dpark 10y ago
> So I guess Microsoft missed both of those deadlines.
No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was no additional 14-day period (for whatever reason).
- scarybeast 10y agoThere is always an additional 14-day period on offer, but the vendor has to choose to use it, and has to actually land the patch within the 14 extra days. So, a deadline miss is often really a 104 (!!) day deadline miss. As an industry that's trying to refocus on security, surely we can do better than that.
- actuator 10y agoI think OP meant that Microsoft missed the deadline by not even having the fix ready that would have earned them the 14 day grace period.
- Heliosmaster 10y agoor they did not communicate anything to P0
- qeternity 10y agoThe grace period isn't automatic, otherwise that would just be a 104 day window. The grace period applies when the vendor has been in communication with P0 that a patch is in the works and will be released within 2 weeks of the end of the 90 day window. Presumably that didn't happen here.
- dpark 10y agoI wasn't proposing that it was automatic. "For whatever reason" means just that. I wasn't making any statement about why there was no additional 14-day window.