4 ms·

Despite the long wall of text I just posted, I forgot to mention: some clever person is inevitably going to come at the end of this whole process and say "oh h

Despite the long wall of text I just posted, I forgot to mention: some clever person is inevitably going to come at the end of this whole process and say "oh hey guys? I figured out another way to trigger this bug" and you start over from the beginning.

spydum 12y ago
start over? the 90 days is not spent attacking the code.. it's split across testing/packaging/etc. The developers can continue to pour over the code in PARALLEL to the testing to check for similar avenues/triggers, and at any point, push an updated patch, which could move the release date back. Still, how long would it truly take to finish the full cycle? It seems hard to believe it would be months. 90 days is roughly 12+ WEEKS. Let's take a stab in the dark and say it takes 4 weeks to fully test. That means from day one, MSFT would have 8+ weeks of time for developers to attack the problem (yes blah blah patch tuesday, call it 7 weeks if you wish). I don't know their code, and I don't know how pervasive the problem was, but 7 weeks seems pretty generous when you are handed the problem (and not required to fish it out of "user" complaints).
- ethomson 12y ago
  Right. Like I said, it sounds crazy that anything would ever take this long. And I'm not saying that it should take 90 days to get a patch out the door. I'm saying that it plausibly take 90 days to get a patch out the door. For CVE 2014-9390, we had a fix roughly 30 days after we were notified of the vulnerability. In that time, we released patches for the third-party libraries that we use for Git repository management (libgit2 and LibGit2Sharp), we released patches to three versions of Visual Studio and Team Foundation Server, and we worked with the Git for Windows team to ensure that our fixes were nice and compatible. In order to get the VS and TFS patches out the door, we needed all of this time. (In fact, we discovered additional vulnerabilities on Mac OS very late in the process. Had these problems affected Windows, too, we would have needed to throw our patches away and start over with the build / test validation process.) And compared to Windows, Visual Studio is not nearly as big or complex, and can turn these changes around faster.

spydum 12y ago

start over? the 90 days is not spent attacking the code.. it's split across testing/packaging/etc. The developers can continue to pour over the code in PARALLEL to the testing to check for similar avenues/triggers, and at any point, push an updated patch, which could move the release date back. Still, how long would it truly take to finish the full cycle? It seems hard to believe it would be months. 90 days is roughly 12+ WEEKS. Let's take a stab in the dark and say it takes 4 weeks to fully test. That means from day one, MSFT would have 8+ weeks of time for developers to attack the problem (yes blah blah patch tuesday, call it 7 weeks if you wish). I don't know their code, and I don't know how pervasive the problem was, but 7 weeks seems pretty generous when you are handed the problem (and not required to fish it out of "user" complaints).

ethomson 12y ago
Right. Like I said, it sounds crazy that anything would ever take this long. And I'm not saying that it should take 90 days to get a patch out the door. I'm saying that it plausibly take 90 days to get a patch out the door. For CVE 2014-9390, we had a fix roughly 30 days after we were notified of the vulnerability. In that time, we released patches for the third-party libraries that we use for Git repository management (libgit2 and LibGit2Sharp), we released patches to three versions of Visual Studio and Team Foundation Server, and we worked with the Git for Windows team to ensure that our fixes were nice and compatible. In order to get the VS and TFS patches out the door, we needed all of this time. (In fact, we discovered additional vulnerabilities on Mac OS very late in the process. Had these problems affected Windows, too, we would have needed to throw our patches away and start over with the build / test validation process.) And compared to Windows, Visual Studio is not nearly as big or complex, and can turn these changes around faster.