4 ms·
"Project Zero's disclosure deadline policy has been in place since the formation of our team earlier in 2014. It's the result of many years of careful considera
by george_ciobanu 10y ago
"Project Zero's disclosure deadline policy has been in place since the formation of our team earlier in 2014. It's the result of many years of careful consideration and industry-wide discussions about vulnerability remediation. Security researchers have been using roughly the same disclosure principles for the past 13 years (since the introduction of "Responsible Disclosure" in 2001), and we think that our disclosure principles need to evolve with the changing infosec ecosystem. In other words, as threats change, so should our disclosure policy.
On balance, Project Zero believes that disclosure deadlines are currently the optimal approach for user security - it allows software vendors a fair and reasonable length of time to exercise their vulnerability management process, while also respecting the rights of users to learn and understand the risks they face. By removing the ability of a vendor to withhold the details of security issues indefinitely, we give users the opportunity to react to vulnerabilities in a timely manner, and to exercise their power as a customer to request an expedited vendor response."
From https://www.engadget.com/2015/01/02/google-posts-unpatched-microsoft-bug/ https://www.engadget.com/2015/01/02/google-posts-unpatched-m...
- user5994461 10y ago> On balance, Project Zero believes that disclosure deadlines are currently the optimal approach for user security You mean, like when they disclosed the cloudflare vulnerability after about a week and then the web turned into a race to whomever could find older-than-a-week cache with valuable information.
- govg 10y agoThere was a discussion on this in the report itself; the vulnerability was far too huge for it to go undisclosed for 90 days, I believe.
- forgot-my-pw 10y agoAnd it was disclosed after the Cloudflare announcement, IIRC
- Buge 10y agoBasically it was required to be disclosed for it to be "fixed" further. The action that needed to be taken was for everyone to delete their web caches. And everyone can't delete their web caches unless they know about the vulnerability.
- bb611 10y agoThe danger of wider knowledge was significantly eclipsed by the danger of a malicious attacker finding the cached data without public knowledge. The vast majority of the people scrambling to find an older cache were the owners of those caches, who really didn't want to own data they shouldn't have been sent in the first place.
- cavanasm 10y agoThey disclosed the cloudflare issue after cloudflare confirmed that the issue was resolved (no additional data was being leaked). The fact that data existed from before then wouldn't have changed at any point for anyone who simply said, "No, we're keeping this random data that could be valuable".