> If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. So? As a ge

> If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. So? As a general rule, people (and companies) have the right to say things like "I'll do X if you do Y" or "I'll do X unless you do Y". It becomes blackmail under certain circumstances, like where you're threatening to harm someone illegally, or demanding money for covering up a crime. In this case, Google picked a 90-day disclosure timeline which seems to be considered generally reasonable by the security community, so I don't see how they're doing anything wrong by sticking firmly to it. > Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough". Yup, sounds like competition to me. > Imagine the next bug they find in Windows, and they publish it saying "ChromeOS doesn't have this bug!". Yup, sounds like competition to me. Maybe I'm just being dense but it would help if you could explain why you think this is "anti-competitive." To me, forbidding a company from trying to demonstrate that its product is more secure than its competitors' is anti-competitive. > Would Google publish their own vulnerability if they were unable to fix it in 90 days? Maybe, maybe not. Presumably since Microsoft has so many employees and cares so much about security, it has its own team of researchers dedicated to finding bugs in Chrome, right? Or is it Google's responsibility to find everyone's bugs, and then give them as much time as they want to fix them?