7 ms·

Google's action resulted in a security bugfix which improved the security of Windows, and on faster schedule than Microsoft would have provided otherwise. But s

• outside1234 12y ago
  I get that. I don't get that they didn't let Microsoft fit it into their patch schedule (2 days later). I don't believe for a second that they would have disclosed this if it was Android and they had a fix that would land within 2 days. No f'ing way. That's the evil.
  • cheald 12y ago
    Microsoft's patch schedule was going to be 32 days later. The hard stance produced a positive outcome here; the patch was available a full month earlier than it otherwise would have been. There is a lot of history between security researchers and big vendors, where the big vendor just delays and delays and delays while the bug is running around out in the wild. I really do hear what you're saying, and while I'm sympathetic to it, I think that it's much more likely that the Project Zero team adopted the 90-day policy specifically because of years and years of vendors playing push-the-deadline. If there was an industry history of vendors acting promptly in good faith, this wouldn't even be a thing, but the politics behind bug reporting and disclosure are really pretty mature at this point, and I really do think it's naive to just chalk it up to "Google wants to embarrass its competition and is playing dirty to do it".