4 ms·
tptacek, are there significant changes in the vulnerability landscape since 2010 that could have led to Microsoft's change in position?
by jdp23 13y ago
tptacek, are there significant changes in the vulnerability landscape since 2010 that could have led to Microsoft's change in position?
- tptacek 13y agoI can't think of any. Just inertia on MSFT's part. This is just part of the overall trend of legitimizing vulnerability research, instead of trying to ostracize or (worse) legally threaten them.
- lawnchair_larry 13y agoThere has been a change in the industry. Actually the change happened much earlier, Microsoft just couldn't remain in denial anymore and were often criticized for ingesting so much free research while giving nothing back. Basically if you had a Microsoft vulnerability and you decided that you wanted to disclose it, you would just go through a broker (such as ZDI) who would deal with Microsoft, but also pay you. The other options were full disclosure, or selling it on the grey market. There are major vendors who are far worse than Microsoft, such as Oracle and Adobe, but they are just so bad that nobody expects anything of them. tl;dr Google has been making them look bad.