3 ms·

> See instead https://news.ycombinator.com/item?id=27680941 https://news.ycombinator.com/item?id=27680941, which is my understanding of the stance p0 takes. Th

> See instead https://news.ycombinator.com/item?id=27680941 https://news.ycombinator.com/item?id=27680941, which is my understanding of the stance p0 takes. That's a common sentiment I just don't buy. People here love to hand-wave about some vague "benefit to the public", and maybe there is some benefit when the vulnerability can be mitigated on the user side, but it literally cannot be the case for the fraction of vulnerabilities that entities other than the vendor can do nothing about. The only "benefit" is it satisfies peoples' curiosity, which is a terrible way to do security. Yet P0 applies that policy indiscriminately. > Can you point out the second part, specifically where "you're a bad vendor if..." is either stayed or implied py P0? As to your question of when this is implied by P0, to me their actions and lack of a compelling rationale for their behavior I explained above is already plenty enough to imply it. But if you won't believe something unless it's in an actual quote from themselves, I guess here's something you can refer to [1]: - "We were concerned that patches were taking a long time to be developed and released to users" - "We used this model of disclosure for over a decade, and the results weren't particularly compelling. Many fixes took over six months to be released, while some of our vulnerability reports went unfixed entirely!" - "We were optimistic that vendors could do better, but we weren't seeing the improvements to internal triage, patch development, testing, and release processes that we knew would provide the most benefit to users." - "If most bugs are fixed in a reasonable timeframe (i.e. less than 90 days), [...]" All the "reasonable time frame (i.e. < 90 days)", "your users aren't getting what they need", "your results aren't compelling", "you can do better", etc. are basically semi-diplomatic ways of saying you're a bad vendor when you're not meeting their "reasonable" 90-day timeline. [1] https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl...

joshuamorton 5y ago
They literally directly describe it as a benefit to users, the sentiment you don't buy, and don't ever actually call vendors bad, except if you interpret the less benefit to users to be a moral impugnment of the vendors. What you cite proves my point!
- dataflow 5y ago
  > They literally directly describe it as a benefit to users "It" in that sentence does not refer to their own unpatched disclosures. > They don't ever actually call vendors bad, except if you interpret the less benefit to users to be a moral impugnment of the vendors. What you cite proves my point! Okay well now I'm definitely convinced.

joshuamorton 5y ago

They literally directly describe it as a benefit to users, the sentiment you don't buy, and don't ever actually call vendors bad, except if you interpret the less benefit to users to be a moral impugnment of the vendors. What you cite proves my point!

dataflow 5y ago
> They literally directly describe it as a benefit to users "It" in that sentence does not refer to their own unpatched disclosures. > They don't ever actually call vendors bad, except if you interpret the less benefit to users to be a moral impugnment of the vendors. What you cite proves my point! Okay well now I'm definitely convinced.