3 ms·
That's still more or less 120 days ago. Well over the 90 day typical window.
by gabeio 2y ago
That's still more or less 120 days ago. Well over the 90 day typical window.
- tptacek 2y agoI'm not saying it's bad (I'm pretty close to a disclosure absolutist), though I don't really know what the norms are for hardware attacks --- both papers are well past the normal coordinated disclosure window for software.
- hashstring 2y agoThe vendor requested embargo timelines can get pretty crazy. Intel requested an embargo for 21 months for SRBDS/Crosstalk. For Downfall, a more recent one, Intel requested a 12 month embargo to release a microcode update.
- tptacek 2y agoFor all I know, that might be a reasonable ask for these kinds of vulnerabilities --- not that researchers have to honor them.