4 ms·
Just want to make this clear, this is the standard disclosure policy of Google: > [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days ela
by mikhailt 8y ago
Just want to make this clear, this is the standard disclosure policy of Google:
> [NOTE: This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report - including any comments and attachments - will become visible to the public.]
Note the "or a patch has been made broadly available". 90 days policy almost never apply when there is a patch released.
It does not make sense to keep the vuln report hidden when a patch comes out, the act of the patch itself reveals the security issue for anyone who takes the time to check what it does.
- infogulch 8y agoThis is exactly why epic didn't and shouldn't get the full 90 days -- users that haven't yet updated are more insecure with the patch out than before. The only thing Google should have done better is make it clear to epic that they will lift it in 7 days, not the 90 that they asked for. Epic could have known by looking at other incidents, but based on their request they obviously did not and Google should have corrected them.