There are strong arguments on both sides, IMO. I especially agree with the potential for EU members to send the feed directly to their intelligence agencies' ex

There are strong arguments on both sides, IMO. I especially agree with the potential for EU members to send the feed directly to their intelligence agencies' exploit development divisions. The biggest gap I see in the open letter is this part: "Require reporting to agencies of mitigatable vulnerabilities only, within 72 hours of effective mitigations (e.g., a patch) becoming publicly available." There are a surprising number of commercial software vendors as well as open source projects that will happily sit on severe vulnerabilities[1] for many months, even years before issuing a patch. Some will ignore them entirely. In a tiny minority of cases I've encountered, that kind of delay is justifiable. When I reported CVE-2023-21541 to Microsoft,[2] they asked for something like six months to build and test a patch, and I felt like that was reasonable, because fixing the bug meant changing the way Task Scheduler worked in a way that could potentially break automated processes (including Windows Update) across the world. It was also only meaningfully exploitable in corner cases outside of Microsoft's control. Usually, it's not justifiable. I once sent a detailed writeup of severe vulnerabilities[3] in a widely-used telecom product to something like twenty people who worked for the vendor.[4] After literally a year of asking for status updates, they claimed that somehow all of them had lost the writeup and nothing had been fixed. When we pressed them further, they updated their documentation to include a statement that the recommended configuration for the product was behind a firewall.[5] No patch, no disclosure of the issues to their customers. The suggestion needs some additional deadlines, IMO, or it completely defangs the EU's requirement. For vulnerabilities being actively exploited (not by good-faith researchers) vendors should be required to report the vulnerability to the EU either within 72 hours of effective mitigations being made available, or 7 days, whichever occurs first. For vulnerabilities reported to the vendor by good-faith researchers that would allow attackers to compromise instances of the product/service (or the underlying host/device), or retrieve sensitive data without authorization, 72 hours or 90 days, whichever occurs first. If a vendor can provide very compelling evidence, maybe allow them an extension to 180 days. [1] The ability to execute arbitrary code on a remote system, obtain unauthorized administrative access, retrieve sensitive data belonging to other users, etc., with full exploit code provided to the vendor/maintainer. [2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21541 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... [3] Unauthenticated remote code execution, hardcoded administrative passwords for almost every network service, etc. [4] I worked for a customer of the vendor, and the report went to everyone on an email thread about the issues.