3 ms·

This is true for open-source but not as much for closed-source as in this case. Also, how does it ever help anyone to have the details released? It only helps

This is true for open-source but not as much for closed-source as in this case. Also, how does it ever help anyone to have the details released? It only helps the researchers for PR and bad actors, never the users who need to apply the patch (and often need some time to, one can't just upgrade something out of nowhere in less than 24 hours).

ziddoap 3y ago
>This is true for open-source but not as much for closed-source as in this case. It is just as applicable to closed-source as it is open-source. The people who are good at developing exploits are, unsurprisingly, good at reverse engineering and using disassemblers. It is generally trivial to figure out exactly what issues a patch is fixing if you are an experienced reverse engineer, and it's a short journey to developing an exploit once you have that knowledge. >Also, how does it ever help anyone to have the details released? Because the details will illuminate many potential indicators of compromise, which can be used throughout the defense stack (e.g. YARA rules, ASA rules, etc.)