3 ms·
I fundamentally disagree with your point of 'a patch should be released as soon a possible'. A patch releases the fix, but by necessity also puts a bright targ
by PeterStuer 7y ago
I fundamentally disagree with your point of 'a patch should be released as soon a possible'.
A patch releases the fix, but by necessity also puts a bright target on the vulnerability it fixes by providing the information on potential exploitable vulnerabilities in the system being patched. From that moment on it is a race between reverse engineering exploit writers and system maintainers to get their work done first.
Having coordination and predictable planning where possible allows companies to include security maintenance into the workload, rather than to have to constantly scramble and react to unforeseen and unpredictable wildfires.
It is not about 'convenience', it is a component of a mature security process.
- SmellyGeekBoy 7y agoSecurity by obscurity. Surely the information on the vulnerability is already out there by the time the patch is released?
- onli 7y agoNo, not necessarily. That's the point of those disclosure timelines.
- Dylan16807 7y agoSecurity by obscurity can work just fine when it's a two week extension on a bug that has existed for years.
- pixl97 7y agoBut it never ends at two weeks. Time and time again the vendors will put it off for years if you let them.
- Dylan16807 7y agoI'm defending monthly patches here, not giving vendors extra time.