3 ms·

My beef is with the established protocol (Google or not) and that is that you disclose enough details to potentially repro even if the vendor patches correctly

My beef is with the established protocol (Google or not) and that is that you disclose enough details to potentially repro even if the vendor patches correctly and promptly. Why the hell suddenly put everyone's devices at immediate risk until they get a chance to update? That's "responsible"?

drenvuk 7y ago
Too many companies dont want to patch and won't do so unless forced.
- mehrdadn 7y ago
  Yes, that's why you disclose if they don't do that. Not if they do.
  - drenvuk 7y ago
    Then it turns into blackmail. Indifference to their actions is necessary.
  - robocat 7y ago
    A patch for a security flaw exposes the flaw to anyone with deep enough pockets to reverse engineer the patch. Disclosing the flaw even if patched helps everyone, including you and me.
metafunctor 7y ago
I don't believe serious vulnerabilities, patched or not, would stay secret for long even if you tried. Disclosing motivates vendors to build systems to ensure users update their devices as quickly as possible.