3 ms·

What if other people already know about the breach? Would you prefer the joy of ignorance, or would you rather protect yourself by some means?

smackfu 12y ago
Does it really matter if it's 90 or 92 day disclosure?
- cskau 12y ago
  Or you could ask: do two more days of the bug being secretly exploited in the wild matter?
  - Gigablah 12y ago
    As opposed to 2 days of the bug being openly exploited?
- JumpCrisscross 12y ago
  > Does it really matter if it's 90 or 92 day disclosure? Yes. Google designed Project Zero to "pressure firms into dealing with security problems more quickly." A firm policy with unambiguous enforcement has its advantages. Muddying the 90-day deadline with questions about when (and for whom) to make exceptions weakens it. For example, in the future, I expect Microsoft will not wait the extra two days in the event of a security disclosure from Google. One may disagree with the 90-day policy to begin with. I, for one, think it should have had an exception process built in. But while these are Google policies, not laws, I respect them for adhering to published protocol. Even when it was difficult.
  - jenscow 12y ago
    I feel certain if this vulnerability had a higher impact (like remote execution) then it would have been over-ridden - or at least responded to quicker.
cmdkeen 12y ago
What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits. Microsoft do issue out of band updates but they are very rare and for very serious issues. It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled releases. It's also worth pointing out the enterprises time things on the patch Tuesday cycle. An earlier release causes all sorts of implementation problems, especially if only a day or two in advance. In all likelihood you wouldn't see many machines actually updated in that period, but cause significant extra grief.
- deleted 12y ago
  [deleted]
tarpherder 12y ago
Almost everyone was already enjoying 90 days of ignorance. And almost everyone could have enjoyed indefinite ignorance with the same relative safety if Google had waited for patch Tuesday.

smackfu 12y ago

Does it really matter if it's 90 or 92 day disclosure?

cskau 12y ago
Or you could ask: do two more days of the bug being secretly exploited in the wild matter?
- Gigablah 12y ago
  As opposed to 2 days of the bug being openly exploited?
JumpCrisscross 12y ago
> Does it really matter if it's 90 or 92 day disclosure? Yes. Google designed Project Zero to "pressure firms into dealing with security problems more quickly." A firm policy with unambiguous enforcement has its advantages. Muddying the 90-day deadline with questions about when (and for whom) to make exceptions weakens it. For example, in the future, I expect Microsoft will not wait the extra two days in the event of a security disclosure from Google. One may disagree with the 90-day policy to begin with. I, for one, think it should have had an exception process built in. But while these are Google policies, not laws, I respect them for adhering to published protocol. Even when it was difficult.
- jenscow 12y ago
  I feel certain if this vulnerability had a higher impact (like remote execution) then it would have been over-ridden - or at least responded to quicker.

cmdkeen 12y ago

What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits. Microsoft do issue out of band updates but they are very rare and for very serious issues. It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled releases. It's also worth pointing out the enterprises time things on the patch Tuesday cycle. An earlier release causes all sorts of implementation problems, especially if only a day or two in advance. In all likelihood you wouldn't see many machines actually updated in that period, but cause significant extra grief.

deleted 12y ago
[deleted]

tarpherder 12y ago

Almost everyone was already enjoying 90 days of ignorance. And almost everyone could have enjoyed indefinite ignorance with the same relative safety if Google had waited for patch Tuesday.