5 ms·

Does it really matter if it's 90 or 92 day disclosure?

• cskau 12y ago
  Or you could ask: do two more days of the bug being secretly exploited in the wild matter?
  • Gigablah 12y ago
    As opposed to 2 days of the bug being openly exploited?
• JumpCrisscross 12y ago
  > Does it really matter if it's 90 or 92 day disclosure? Yes. Google designed Project Zero to "pressure firms into dealing with security problems more quickly." A firm policy with unambiguous enforcement has its advantages. Muddying the 90-day deadline with questions about when (and for whom) to make exceptions weakens it. For example, in the future, I expect Microsoft will not wait the extra two days in the event of a security disclosure from Google. One may disagree with the 90-day policy to begin with. I, for one, think it should have had an exception process built in. But while these are Google policies, not laws, I respect them for adhering to published protocol. Even when it was difficult.
  • jenscow 12y ago
    I feel certain if this vulnerability had a higher impact (like remote execution) then it would have been over-ridden - or at least responded to quicker.