3 ms·
What about users who are affected by the vulnerability in the time it takes between reporting to the vendor and remediation?
by akerl_ 1y ago
What about users who are affected by the vulnerability in the time it takes between reporting to the vendor and remediation?
- llbbdd 1y agoThat's the tradeoff. If you disclose it broadly without a grace period, someone who didn't even know about the vulnerability before will exploit it faster than even the best postured companies can fix it.
- akerl_ 1y agoThat seems to depend a lot on the vulnerability, and the company, and the users. I'm not suggesting in this thread that coordinating with vendors is bad. I'm suggesting that to frame any non-coordinated disclosure as inherently irresponsible is bad, and that is what is implied when we use the label "responsible disclosure" for "coordinated disclosure".