5 ms·

Replace "zero-day" with "privately reported security bug for which I got $100k" That's not how zero-day works

• saagarjha 6y ago
  It was a zero day up until the first report was made.
  • jedberg 6y ago
    That's always true though. 0-day implies it was discovered being actively exploited or that it was released on the 0th day it was discovered.
    • saagarjha 6y ago
      I believe “0 day” actually refers to the number of days that the vendor has had to fix the issue, not how many days it’s been since it’s discovered. For example, there might be a substantial delay between bug discovery and actual disclosure to the vendor–I usually take a couple days to write up a nice explanation and PoC. If I had found something and then published it publicly the next day without disclosing it, it’d still be a zero day.
      • jedberg 6y ago
        You're right I should have said 0 days since it was disclosed to the vendor. That would be more accurate. Regardless, this bug is definitely not 0 day given that it was disclosed to the vendor last month.
      • afrcnc 6y ago
        It doesn't matter what you "believe" That's not what that word means. Zero-day refers to actively exploited bugs. Stop hijacking words just to overhype your research.
        • saagarjha 6y ago
          I didn't write the article, so I'm not sure what you mean by overhyping my research. But what you mentioned is referred to as "zero day exploited in the wild"; a zero day doesn't have to actually be actively exploited.