There are a number of reasons why the reporting process for bugs needs a blackout window. Just because a security researcher can discover things about a progra

There are a number of reasons why the reporting process for bugs needs a blackout window. Just because a security researcher can discover things about a program that its own developers missed, doesn’t mean they’ve understood the entire picture. If you find one bug, you need to spend time making sure that it doesn’t represent an entire class of bugs. Once the advisory is announced, that’s blood in the water that will attract other predators. Only idiots and tourism companies chum the water before they expect more people to go into it. Back when PHP was objectively awful, I joined the pitchforks and torches mob based on the litany of CERT advisories against it. I had an argument with a coworker about whether PHP was irresponsible to use, and the very next day someone defaced the phpBB instance he maintained because of an unpatched injection attack. I pointedly did not comment because 1) smug and 2) the timing made me nervous of being accused of having been the perpetrator. But I did look at the patch that either just came out or that he missed, and was frustrated to find that the same pattern they fixed existed in two other functions. I really think that it says more about a community, not in what mistakes they make, but how they learn from those mistakes. And I’d like to say it seems like SAP didn’t, but we all know what a beast that thing is. How many tens of millions of lines of code is that thing now? The chances that a person made a mistake and two people they’ve never met copied it are essentially 0.99 repeating.