4 ms·

What is the point of disclosing it if it is not fixed? I understand it is to put pressure and likeness, but doesn't it cause more harm than good? Windows is ve

• deleted 6y ago
  [deleted]
• theptip 6y ago
  This is a foundational policy question in security research, and Project Zero gives a lot of detail on its aproach, e.g. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html https://googleprojectzero.blogspot.com/2020/01/policy-and-di...
  • ffpip 6y ago
    Thanks for sharing the links. I knew it was a policy, but never really looked more into it.
• gene91 6y ago
  It is in the public's best interest to demand timely fix because you never really know whether bad actors know about it. A demand has no teeth, therefore you have to make a threat (fix in 90 days, or we disclose publicly). A threat is only good if you have a track record of delivering on it without exceptions. Therefore, it isn't an option to not disclose it at 90 days.
• albntomat0 6y ago
  A while ago, responsibly disclosed bugs took an extraordinarily long time to be patched. Disclosure deadlines ensure things are patched in a responsive manner. They only work though when the reporter actually follows through if the deadline is missed (and has standing & legal projection to execute like the Project Zero folks).
• TheDong 6y ago
  Historically, vendors often refused to allocate time to patch things for anywhere from months to years. Leaving vulnerabilities in products for an extended period of time is a problem, and adding a deadline helps to ensure that important security issues actually do get triaged and addressed. As a recent project zero blog post about their policy calls out (https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html https://googleprojectzero.blogspot.com/2020/01/policy-and-di...) "We've seen some big improvements to how quickly vendors patch serious vulnerabilities, and now 97.7% of our vulnerability reports are fixed within our 90 day disclosure policy." It sounds like it's working as intended. The only way you can make it actually work is to make sure it has some teeth though, hence you have to actually disclose when you say you will. > doesn't it cause more harm than good? Microsoft is harming its users by not fixing a security vulnerability. In this case, it's even more clear since there's "in the wild" exploits. Project zero's just helping to raise awareness of the harm microsoft's causing.
• codexon 6y ago
  If you've ever try reporting vulnerabilities, you'll see that some companies won't ever fix the problem until it is widespread.
• userbinator 6y ago
  It's not even remotely exploitable, which from the perspective of the fact that the vast majority of computers are owned and used by a single-user, makes it a very low to zero risk. The stakes are very different for disclosing a remotely exploitable vuln.