5 ms·
What do you consider enough time? Google maintains a strict 90 day grace period so that the other party can figure out how to address the issue. If not 90 days,
by cbcoutinho 9y ago
What do you consider enough time? Google maintains a strict 90 day grace period so that the other party can figure out how to address the issue. If not 90 days, what should it be? In a world of complicated software, we need to have a discussion of what vulnerabilities users are subjected to by using a product, and whether/when users should be notified that those vulnerabilities exist
- zaroth 9y agoNot so strict in this case!
- euyyn 9y agoI think your parent meant strict as in "it gets disclosed after 90 days, no extensions".
- deleted 9y ago[deleted]
- fiddlerwoaroof 9y agoThe article said it made a special exception in this case. That being said, unusual circumstances call for unusual procedures.
- euyyn 9y agoMy impression is it's always "90 days or whenever it's made public by other means, whatever happens first".
- fiddlerwoaroof 9y agoHmm, I was under the impression that they've known about Meltdown/Spectre since June and gave themselves an extension. But I'm not sure where I read that.
- djsumdog 9y agoHow much time did they give all the *BSD developers? DragonFly had a patch recently .. in master. OpenBSD just had a rant on their mailing list. Somebody correct me if I'm wrong, but it looks like zero.
- joshuamorton 9y agoDisclosure: I work at Google, but not related to this. Its my understanding that Google disclosed this vulnerability to ARM, Intel, and AMD, and no one else, and left the hardware manufacturers the job of disclosing to the various software vendors. So, they gave 6 months to the people they disclosed the vulnerability to. Those people did or did not disclose it to others.
- rplnt 9y agoI was under the impression Google publicized these vulnerabilities before the period was over. Like 4 or 5 days earlier, not much out of 6 months, but still (I believe MS haven't released patches yet).
- daenney 9y agoThey did, because other people figured out something was up and the speculation was considered more problematic than holding out a few days. As you say, the vulnerability was disclosed to others on the 1st of June, which puts us at 6 months for the disclosure deadline. If 6 months in vendors aren't ready with patches I doubt those few days would have made a significant difference.
- joshuamorton 9y agoSpecifically, there were PoCs floating around on Twitter