2 ms·
He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionall
by monocasa 4y ago
He was one of the most important tech journalists in the world when he was saying this stuff; his fame came before his twitter account. He was also functionally a mouthpiece for Microsoft PR, available to run hit pieces on situations that were otherwise embarrassing for Microsoft.
And project zero puts an emphasis on disclosure, not coordination. When the ticker runs out they nearly always disclose, regardless of where coordination is at. That's what Peter Bright was ultimately complaining about; they disclosed like a week before one of the relevant patch tuesdays.
Like I've said, the primary point isn't the coordination. That's the carrot to get the vendors to play game on a sane schedule because otherwise the vendor holds all the cards.
- tptacek 4y agoI simply don't care what Peter Bright says, and neither does anybody else in the field. We're now arguing for the sake of arguing. It's plainly correct that the term "Responsible Disclosure" is disfavored, and disfavored for the reasons I say it is. I didn't come up with any of these things; I just work in vulnerability research (or used to) and know what the stories are.