3 ms·
Response time is useless if it still takes 7 days to deploy a patch for a simple XSS issue.
by korzun 13y ago
Response time is useless if it still takes 7 days to deploy a patch for a simple XSS issue.
- jsegura 13y agoTotally agree with that. The important time is the one between the disclosure and the fix, not the one between the disclosure and the first response. It could be a bot :)
- nirvanis 13y agoTrust me, Nenad is not a bot :) We work hard on becoming better and faster at tackling these and other issues. We try to learn from incidents and mistakes in order to be faster next time. Thanks for the feedback.
- bestdayever 13y ago(You probably already saw this but if you didn't)Spotify employee already pointed out the bug was fixed within the day the original email was sent. 7 days was probably after an audit to check for the issue in other places and then after 7 days they felt comfortable letting the researcher talk about it. Cheers!