3 ms·

I really like the lead time. It gives everyone time to prepare to patch ASAP when it is released without having the vulnerability available to attackers through

by spockz 6y ago

I really like the lead time. It gives everyone time to prepare to patch ASAP when it is released without having the vulnerability available to attackers through diffing the binary. On the other hand, it gives people that found the vulnerability independently a bit of extra time to exploit.

koolba 6y ago
> It gives everyone time to prepare to patch ASAP when it is released without having the vulnerability available to attackers through diffing the binary. It’s an open source library so the code of the patch will be available as soon as it’s published. It’s not released as a compiled library.
- spockz 6y ago
  Yes, indeed in the case of OpenSSL indeed but I was referring to applying the practice in general. With an open source product the lead time is even more important. Even then, they could release the binaries from a private branch/repository so that packages can be updated before the source is released.