3 ms·
Yes, large companies sometimes screw up. The project zero policy on this is wrong and downvotes won't change my mind on that. You know perfectly well that MS wi
by repolfx 7y ago
Yes, large companies sometimes screw up. The project zero policy on this is wrong and downvotes won't change my mind on that. You know perfectly well that MS will fix it once the right people are in the case, the 90 day "deadline" with working exploit just risks another EternalBlue type situation where the exploit gets used in real attacks and causes real damage, for what?
- Aissen 7y ago> You know perfectly well that MS will fix it once the right people are in the case, No, we don't know that. Companies that were deemed serious have been caught dragging and taking their time with no proof of progress whatsoever (just like in this case?). And think of the message it would send to other (supposedly non-serious) companies: "you've given more time to MS, why not me ? It's only fair". Just like democracy, the P0 policy is the worst form of disclosure, except for all the others. Also, please don't conflate this with EternalBlue, there's no remote component here.
- shkkmo 7y ago> just risks another EternalBlue type situation where the exploit gets used in real attacks and causes real damage, for what? You mean where the US government decided to not notify Microsoft for 5 years? Or you mean where Microsoft decided to publicly announce the vulnerability despite not having provided patches for millions of unsupported systems? These organization the "take security seriously sure make Project Zero look very responsible by comparison. > for what? To let people whose security has been compromised for over a decade do what they can to mitigate
- repolfx 7y agoThey can't do anything to mitigate. What are they meant to do, rewrite parts of Windows by themselves? The only fixes here come from MS. Until then, the more people that know, the worse it is.