I learned a thing or two about this in 2009-2010 when I uncovered a critical SSL/TLS bug CVE-2009-3555. The fix for this bug would require a change to the TLS p

I learned a thing or two about this in 2009-2010 when I uncovered a critical SSL/TLS bug CVE-2009-3555. The fix for this bug would require a change to the TLS protocol itself (RFC 5746) which would take months in the best case, so my boss and I set upon a disclosure plan. (This was long before we ended up employed at MS.) Microsoft, like many other vendors, would need to patch. They were the most responsive, a bit aggressive even, vendors about wanting to get the full details of the bug as soon as possible. We also disclosed the US Government. We did this as part of the planned disclose process to vendors as well as customers and other stakeholders. I felt it was important that there were customers in the process in order to motivate the vendors a bit and so we weren't the only ones taking heat from the vendors. The US Government probably had more affected systems than anybody and it could even be a nat security issue, so we disclosed them. I think it worked. Some of the other (non MS) vendors heard about it via their Federal business and were a little annoyed at us. The US Government really wants to keep their own systems patched. I never did hear of the bug being used in anger (not that I would have), but among the major vendors (Linux distros included), Microsoft was the first to engineer and release a patch and push it down the update channel. We presented the full story (in our Hardy Boys sweaters) here: https://www.youtube.com/watch?v=U_L9WGGEUlU https://www.youtube.com/watch?v=U_L9WGGEUlU