3 ms·
Since when did the term "responsible disclosure" mean allowing the vendor unlimited time to fix it?
by eridius 9y ago
Since when did the term "responsible disclosure" mean allowing the vendor unlimited time to fix it?
- newfoundglory 9y agoIf it's not unlimited, what's the limit? Apparently a month isn't long enough.
- eridius 9y agoThey admitted they never contacted Apple product security, which means they never notified Apple to begin with. That month you see at the top of the writeup appears to be how long they waited for ZDI before deciding to publish, not how long they waited for Apple to fix it.
- lawnchair_larry 9y agoSo what? They owe Apple nothing. They owe you nothing. Unless you are taking requests from random HN commenters for software that you would like to build them for free, I suggest you rethink your suggestion for highly skilled researchers to donate charity labor to the largest corporation in the world.
- eridius 9y agoThis has nothing to do with owing Apple anything and instead has to do with not intentionally compromising the security of millions of innocent people around the world. And before you interpret this to mean never disclosing publicly, that’s not what I’m saying. But no matter what your opinion is on the best way to handle disclosure, releasing a 0day without any attempt whatsoever to notify the vendor is highly irresponsible and immoral.
- lawnchair_larry 9y agoNo, it isn't.
- mcny 9y agoWhen Microsoft decided they needed more than 90 days to release a patch. https://bugs.chromium.org/p/project-zero/issues/detail?id=1011 https://bugs.chromium.org/p/project-zero/issues/detail?id=10... I'd say 30 days is enough. Google was generous with ninety. (They too live in a glass house after all).
- user5994461 9y agoNot everything is a web app that can be patched in 5 minutes and doesn't need to run in one hundred million different environments.