4 ms·
In what world does the recipe for Coca Cola in any way influence the maintenance of a fleet of trucks? Google's policy is responsible disclosure. Wavering on t
by delinka 12y ago
In what world does the recipe for Coca Cola in any way influence the maintenance of a fleet of trucks?
Google's policy is responsible disclosure. Wavering on the well-known deadline would become a political headache. If you give a mouse a cookie... Two days becomes a week; a week becomes half of a month; half a month becomes a full month. Perhaps if Google is feeling generous, they could not disclose a vulnerability to a vendor until a later time (for example, if a vulnerability is found just before a well-known extended holiday or something) thus automatically "extending" the expiration of the quiet period. But that still leaves us, the users, more vulnerable for longer if the bad guys were already aware of the problem.
On a slight tangent, Microsoft's policy to not release security patches as soon as they're available (and instead wait until "patch Tuesday") harms us all. They don't have to forcibly push the fixes, but immediate availability would be a tremendous improvement.
- freehunter 12y agoWhich they're doing with Windows 10. Consumers get them now, business get them on Tuesday. Have you ever deployed patches to a couple thousand machines? It's not something you want to do every night.
- delinka 12y agoWhen to deploy patches to my thousands of machines is my administration problem, not Microsoft's. Giving me the tools to make these decisions puts more power to protect my company into my hands. Denying patches to me simply to fit a schedule denies me flexibility and, potentially, security.
- WorldWideWayne 12y agoMicrosoft first has to test and deploy the patch to their servers, not yours. At the level they're operating, a schedule seems like an obvious requirement for releasing patches.
- delinka 12y agoOf course they have to test internally first. Once the patch is validated, why sit on it for three weeks waiting for that arbitrary date? Put it out as soon as it's ready.
- WorldWideWayne 12y agoCould you provide a citation for Microsoft sitting on it for three weeks?