4 ms·

90 days policy is fine. If you can fix the problem, this time will be enough to hire an entire team.

• chrisseaton 8y ago
  > 90 days policy is fine. If you can fix the problem, this time will be enough to hire an entire team. Is 90 days enough to fully fix for example spectre and meltdown? I'm not sure all bugs can be fixed in 90 days. Some will take decades to resolve.
  • plopz 8y ago
    Spectre/Meltdown were given 6 months instead of the normal 90 days.
  • ox_cable 8y ago
    Spectre is a special case and I think you know it's a special case. Cut it out.
    • chrisseaton 8y ago
      Why's it not a valid counter-example? It's a special case because it doesn't fit the 90 day estimate? Well yeah that's why it's a counter-example.
      • joshuamorton 8y ago
        Because at it's core, it's a hardware design flaw, not a software bug. Also it affected multiple vendors, not one, so coordination across a minimum of 10 major organizations (google, apple, MS, Amazon, Intel, amd, Linux, etc.) breaks the normal assumptions behind project 0. Given those issues, different rules make sense. It's not a normal case where a single vendor has a flaw that can be fixed with a single patch.
  • forgot-my-pw 8y ago
    You can request for an extension (grace period). The point is, Apple didn't respond until it was too late. https://googleprojectzero.blogspot.com/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.com/2015/02/feedback-and-...