3 ms·
>Deadlines serve the users --- not just of the vulnerable software, but of all the other users that might depend on the people who use that software in some ind
by ksk 9y ago
>Deadlines serve the users --- not just of the vulnerable software, but of all the other users that might depend on the people who use that software in some indirect way.
What if a user/users would rather a company spend their resources into adding a feature they care about, than fixing a bug that doesn't impact them? (Not that I disagree with Google's position here..., just a contrarian view)
- tptacek 9y agoThat's not a contrarian view. It is a widely-held view. Plenty of IT administrators would rather not think about security, which is largely an externality to their job. If they're inconvenienced by the 90 day deadline, they have Microsoft to blame for it, not Google.
- adrianmonk 9y agoUnless they plan to never fix it, they are going to eventually spend resources. Deadlines just force the issue of when those resources are spent. They are still spent either way. And if they don't have any intention of ever fixing it, it basically doesn't matter when it is disclosed. So in that case, having a deadline is no worse. Yes, sometimes you can be more efficient if you have your choice of when to do something, but that's usually a relatively minor effect.