3 ms·

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesda

by wampus 12y ago

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesday is a restriction that Microsoft imposes on itself and its users. They had advanced warning and an opportunity to work within the limits of their own policy or roll out an unscheduled update. Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?).

_wmd 12y ago
Given that Microsoft had excellent reason to ask for an extra 2 days, I guess the real question is that for a data-driven organization, why Google think 90 days is such a good number in the first place, and why they insisted on sticking to it despite the asinine alternative (forcing tens of thousands of IT departments to coordinate an out of band change for a low severity bug).
300bps 12y ago
A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process. Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?
forgottenpass 12y ago
Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?). This looks like a solution, but isn't. Perhaps Google's 90 day deadline is already a re-evaluation of a 60-day deadline that was made to accommodate holidays and companies with a once-a-month patch schedule. If Google's deadline was 120 and still hit two days before patch Tuesday, would you say the same thing but for 150? (N.B. I'm not defending Google, just poking a hole in this particular idea.)

3 ms·

There's no question that the hard 90-day deadline of Google's Project Zero is undermined by collisions with holidays and other calendar events, but Patch Tuesda

by wampus 12y ago

_wmd 12y ago
Given that Microsoft had excellent reason to ask for an extra 2 days, I guess the real question is that for a data-driven organization, why Google think 90 days is such a good number in the first place, and why they insisted on sticking to it despite the asinine alternative (forcing tens of thousands of IT departments to coordinate an out of band change for a low severity bug).
300bps 12y ago
A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process. Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?
forgottenpass 12y ago
Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?). This looks like a solution, but isn't. Perhaps Google's 90 day deadline is already a re-evaluation of a 60-day deadline that was made to accommodate holidays and companies with a once-a-month patch schedule. If Google's deadline was 120 and still hit two days before patch Tuesday, would you say the same thing but for 150? (N.B. I'm not defending Google, just poking a hole in this particular idea.)