4 ms·
They keep calling it a zero-day although it is not. I dont know which one is worse, if they don't know the meaning or they are trying to make it look like somet
by psKama 5y ago
They keep calling it a zero-day although it is not. I dont know which one is worse, if they don't know the meaning or they are trying to make it look like something more important than what it really is.
- aws-dev 5y agoWhy do you say it's not a zero-day? It was unknown to AWS when they reported it.
- otterley 5y agoThat's not what zero-day means. Zero-day means that every affected system is vulnerable the day the vulnerability is publicly disclosed. That was not the case here as the vulnerability was addressed nearly four months before today's announcement.
- aws-dev 5y agoFair enough. I went off the wikipedia definition ("vulnerability unknown to those who should be interested in its mitigation"), which doesn't mention it has to be known to the general public. We had to treat it as a zero-day when it was reported, because we had to assume there might be other parties who knew about it. (I work for CloudFormation)