3 ms·

So back a long time ago, we counted days from the time an exploit was 'known'. Now people seem to use it for the time since a patch has been released? I don't

So back a long time ago, we counted days from the time an exploit was 'known'. Now people seem to use it for the time since a patch has been released? I don't know, but every time I ask I get downvoted.

judge2020 6y ago
A 0-day generally means either one person, a single organization, or a small group of people, know about the exploit in question. As soon as an exploit is widely known or published, it's not a 0-day since anyone can find it, even if the exploit is for abandoned software that'll never receive a security fix.
- ltbarcly3 6y ago
  Yep, that's what I said I think (by 'known' I meant publicly). Once it's widely known, it's a 0 day for 24 hours, then it's not anymore. That's what we used to mean by 0-day anyway. Other people will tell you that it's a 0-day until there is a patch against it. I think different people use this this phrase so divergently that using it isn't a useful way to communicate anymore.
  - neltnerb 6y ago
    What is it called after there is a patch against it? Does it just stay at like a 27-day if it takes 27 days to patch? I feel like in common parlance calling something a 0-day would imply that it is something the manufacturer didn't expect and has no solution for which is a big problem. I guess whatever communicates information best. I kind of feel like we just use 0-day to mean big problems, everything else is just a bug that has some age, and then fixed stuff doesn't get remembered. Right? That seems fairly useful, at least in communicating to the general tech media.
    - aj3 6y ago
      If you know about the bug, but manufacturer does not provide any patches, you can still mitigate it, put in place detection measures or just stop using that software. You can't (necessarily) do those if you don't even know about the bug yet as it hasn't been published. That's why 0day is a useful term.
waheoo 6y ago
Not "known", but "disclosed" to the public, or at least those responsible for a patch. Zero days are known, exploited and used all the time by all sorts of black hats, govt institutions etc.
cheschire 6y ago
Username checks out.
bawolff 6y ago
At this point bloggers seem to mostly use 0-day to mean: i havez cool 1337 hackorz skillz, regardless of merit.

judge2020 6y ago

A 0-day generally means either one person, a single organization, or a small group of people, know about the exploit in question. As soon as an exploit is widely known or published, it's not a 0-day since anyone can find it, even if the exploit is for abandoned software that'll never receive a security fix.

ltbarcly3 6y ago
Yep, that's what I said I think (by 'known' I meant publicly). Once it's widely known, it's a 0 day for 24 hours, then it's not anymore. That's what we used to mean by 0-day anyway. Other people will tell you that it's a 0-day until there is a patch against it. I think different people use this this phrase so divergently that using it isn't a useful way to communicate anymore.
- neltnerb 6y ago
  What is it called after there is a patch against it? Does it just stay at like a 27-day if it takes 27 days to patch? I feel like in common parlance calling something a 0-day would imply that it is something the manufacturer didn't expect and has no solution for which is a big problem. I guess whatever communicates information best. I kind of feel like we just use 0-day to mean big problems, everything else is just a bug that has some age, and then fixed stuff doesn't get remembered. Right? That seems fairly useful, at least in communicating to the general tech media.
  - aj3 6y ago
    If you know about the bug, but manufacturer does not provide any patches, you can still mitigate it, put in place detection measures or just stop using that software. You can't (necessarily) do those if you don't even know about the bug yet as it hasn't been published. That's why 0day is a useful term.

waheoo 6y ago

Not "known", but "disclosed" to the public, or at least those responsible for a patch. Zero days are known, exploited and used all the time by all sorts of black hats, govt institutions etc.

cheschire 6y ago

Username checks out.

bawolff 6y ago

At this point bloggers seem to mostly use 0-day to mean: i havez cool 1337 hackorz skillz, regardless of merit.