3 ms·
More often than not announcing the existence of a vulnerability is enough to motivate people to find it. It’s much easier to find something that you know is the
by enneff 7y ago
More often than not announcing the existence of a vulnerability is enough to motivate people to find it. It’s much easier to find something that you know is there than to just experiment blindly.
- yumraj 7y agoFair enough, but that can be countered by very minimal disclosure in the beginning, just that a vulnerability exists and it has been notified. Even if we don't do that, I think we should at least reveal the issue after it's been fixed in all the cases so that other entities can learn from that.
- o-__-o 7y agoYes. I learned the security release process for a major open source software and it became trivial to determine when vulnerabilities are patched and knowledge of their build process gives you an exact window to exploit said 0-day