4 ms·
To anyone who still thinks a 90-days deadline (with up to 14 additional days for patch release alignment) isn't fair enough, I invite you to look at the timelin
by Aissen 7y ago
To anyone who still thinks a 90-days deadline (with up to 14 additional days for patch release alignment) isn't fair enough, I invite you to look at the timeline for this report:
https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html https://blog.quarkslab.com/reverse-engineering-broadcom-wire...
This is is remote code exec on any device. Yet without hard deadlines, vendors stall, lie, etc. This isn't the first example of this. There has been many throughout the past. Project Zero's policy is actually very well thought, and state of the art IMHO.
- oaiey 7y agoI think it is fair and necessary as an incentive to immediately start working on it. It is also right to publish them after 90 days. I just think it is not fair to blame or make fun of companies for failing on delivery within 90 days what happens here regularly (see: upvotes for the article). When developing a low risk application with a fancy DevOps infrastructure everyone expect bug fix delivery in hours or maximum the 2 weeks sprint. 90 days is not much time when patching operating systems or mission critical software. Windows is used in literally all regulated environments, from aircrafts to medical devices. The amount of necessary paper work and the amount testing to reduce risk is beyond what anyone not in that business can imagine.
- SmellyGeekBoy 7y ago> I just think it is not fair to blame or make fun of companies for failing on delivery within 90 days what happens here regularly (see: upvotes for the article). Are people upvoting just to "make fun" of Microsoft? I assumed it was for visibility or to share an interesting insight into the inner workings of the security industry.
- oaiey 7y agoYeah, but security incidents like that happen every month. We should be long bored of it.
- kriro 7y agoQuite frankly, a multi billion dollar software company like Microsoft should be ashamed of themselves for not fixing a 0-day in 90 days. Even with all the non-coding involved and rolling it out properly they should probably be ashamed if they can't do it in a week.
- wglb 7y agoHow about not putting the flaw in in the first place?
- Operyl 7y agoWho writes perfect code? Generally speaking, I find the more people working on a single codebase the more chance you have for introducing flaws.
- wglb 7y agoThere are many examples of near perfect code.
- mrguyorama 7y agoYet you did not name examples?
- AnaniasAnanas 7y agoHow about NaCl and basically almost everything made by DJB?