3 ms·
I've not yet seen anyone comment on the fact that Dell was informed in late Oct, confirmed by late Nov...and the public was advised in mid April. That's a lot
by ergothus 7y ago
I've not yet seen anyone comment on the fact that Dell was informed in late Oct, confirmed by late Nov...and the public was advised in mid April. That's a lot of time for a known and confirmed vulnerability to be undisclosed, isn't it?
- mosdl 7y agoCould be that it took a while to distribute the fix to all the affected PCs?
- ergothus 7y agoI'm sure it did, but this is the classic debate about disclosure: disclosing before the fix means that there will be more attackers. Not disclosing means anyone already exploiting the vulnerability is unwarned and defenseless. And sometimes, disclosing before a fix means the fix suddenly has resources and priority it didn't before. I usually hear about 90 day disclosure, not 160(ish). I'm not saying there should have been disclosure before the fix in this case...but I'd rather see more discussion on that than yet another vendorware complaint. (which are valid, but hardly news)
- driverdan 7y agoI would have publicly disclosed after 90 days. A single line of code would have closed the URL problem and could have been deployed the next day. Six months is ridiculous.
- obisw4n 7y agoI'm not surprised in the least, they have a Bugcrowd program and I've submitted atleast one P2 that took months to fix, and best of all - they don't pay bounties! what a joke if you ask me.