3 ms·

The reason it is considered a 0day is because it is being exploited in the wild. This wasn't discovered by a security researcher looking for holes. This was d

The reason it is considered a 0day is because it is being exploited in the wild. This wasn't discovered by a security researcher looking for holes. This was discovered by a virus scanning company that realized people were actively being attacked using this method.

saagarjha 6y ago
It was a 0-day at that point. Right now it is a 90-day.
- albntomat0 6y ago
  Only to Project Zero and Microsoft. Everyone else has known about it for exactly 2 hours.
  - saagarjha 6y ago
    Days are counted by how long a vendor has known about a bug, not the general public.
    - albntomat0 6y ago
      My understanding of the term is days are counted in the view of "the defender," which is more than Microsoft
      - saagarjha 6y ago
        Microsoft would always be the first to know of the defenders–any other defender would just tell them. It then makes sense to count from there, rather than have multiple counts for each level of people learning of the vulnerability.
        albntomat0 6y ago
        I think your argument makes sense when the day counts are close to each other. There really isn't any difference between a 55-day and a 57-day, nor does it make sense to account for some sysadmin who took a vacation day. I still think that your usage of "0-day" breaks down precisely in the case we're in currently, where the vulnerability has been exploited in the wild and Microsoft has known about it for some time, but there is not a patch available, and the general public (everyone who has to defend against the exploit) found out about it today.
    - luch 6y ago
      Not exactly, historically days are counted by how long the editor has provided a patch fixing the bug, as in "you[the adminsys] had X many days to apply the bugfix". 0day means no patch is available, whether the vulnerability is known privately/publicly or not
      - saagarjha 6y ago
        If you (the public) learn of the exploit at the same time as the vendor, then it is still a 0-day. You can construct a definition where it is "a zero day to you, the sysadmin" but that would really make it difficult to pick a single day to measure from. For this reason the most useful definition would be to measure from the defender with the earliest knowledge, which would be the vendor.
        dmix 6y ago
        This seems to be a phrase that has a matter of perspective. I always see people trying to nail down a meaning but it always seems to little effect in day to day discourse. I’m a fan of letting context infer meaning. And letting certain words just naturally grow to whatever the culture wants it to. It’s always hard to fight back against it. There’s a million examples of this on the internet where people try to be pedantic about slang or word usage. All that matters is “we know what you mean”. I like to assume enough people here know the real difference zero days vs existing vulnerabilities are. But in practice it matters less.
        wcoenen 6y ago
        People have debated prescriptive vs descriptive linguistics for centuries, it will not be resolved here. https://www.bartleby.com/73/2019.html https://www.bartleby.com/73/2019.html

saagarjha 6y ago

It was a 0-day at that point. Right now it is a 90-day.

albntomat0 6y ago
Only to Project Zero and Microsoft. Everyone else has known about it for exactly 2 hours.
- saagarjha 6y ago
  Days are counted by how long a vendor has known about a bug, not the general public.
  - albntomat0 6y ago
    My understanding of the term is days are counted in the view of "the defender," which is more than Microsoft
    - saagarjha 6y ago
      Microsoft would always be the first to know of the defenders–any other defender would just tell them. It then makes sense to count from there, rather than have multiple counts for each level of people learning of the vulnerability.
      - albntomat0 6y ago
        I think your argument makes sense when the day counts are close to each other. There really isn't any difference between a 55-day and a 57-day, nor does it make sense to account for some sysadmin who took a vacation day. I still think that your usage of "0-day" breaks down precisely in the case we're in currently, where the vulnerability has been exploited in the wild and Microsoft has known about it for some time, but there is not a patch available, and the general public (everyone who has to defend against the exploit) found out about it today.
  - luch 6y ago
    Not exactly, historically days are counted by how long the editor has provided a patch fixing the bug, as in "you[the adminsys] had X many days to apply the bugfix". 0day means no patch is available, whether the vulnerability is known privately/publicly or not
    - saagarjha 6y ago
      If you (the public) learn of the exploit at the same time as the vendor, then it is still a 0-day. You can construct a definition where it is "a zero day to you, the sysadmin" but that would really make it difficult to pick a single day to measure from. For this reason the most useful definition would be to measure from the defender with the earliest knowledge, which would be the vendor.
      - dmix 6y ago
        This seems to be a phrase that has a matter of perspective. I always see people trying to nail down a meaning but it always seems to little effect in day to day discourse. I’m a fan of letting context infer meaning. And letting certain words just naturally grow to whatever the culture wants it to. It’s always hard to fight back against it. There’s a million examples of this on the internet where people try to be pedantic about slang or word usage. All that matters is “we know what you mean”. I like to assume enough people here know the real difference zero days vs existing vulnerabilities are. But in practice it matters less.
        wcoenen 6y ago
        People have debated prescriptive vs descriptive linguistics for centuries, it will not be resolved here. https://www.bartleby.com/73/2019.html https://www.bartleby.com/73/2019.html