4 ms·
What's the etiquette for disclosure timeline on something like this? It feels like 99.9999% of end users won't see this public disclosure, and waiting enough ti
by scosman 9y ago
What's the etiquette for disclosure timeline on something like this? It feels like 99.9999% of end users won't see this public disclosure, and waiting enough time for auto-updates to be applied would be ideal. Public disclosure as soon as the patch is available lets bad actors know about it while the vast majority of users are still vulnerable.
- tedivm 9y agoProject Zero is very aggressive about releasing exploit details as soon as a patch is available- they don't wait for users to actually have a chance to upgrade. This caused some drama when they were releasing vulnerabilities to password managers.
- jwilk 9y agoIn the free software world, full disclosure when the fixed version is available is a normal practice. Partial diclosures are rather frowned upon.
- tetha 9y agoThe bad actors pay people to find these issues. It's prudent to assume that blackhats know about this already anyway. Thus, it's beneficial to push fixes asap in order to minimize the window for the blackhats. It's a choice between visible pain and invisible weakness. The early disclosure hurts and amplifies the issue. However, the malicious actors you need to worry about would be glad for every day without disclosure, because every day without disclosure is profit to them.