Right. Like I said, it sounds crazy that anything would ever take this long. And I'm not saying that it should take 90 days to get a patch out the door. I'm

Right. Like I said, it sounds crazy that anything would ever take this long. And I'm not saying that it should take 90 days to get a patch out the door. I'm saying that it plausibly take 90 days to get a patch out the door. For CVE 2014-9390, we had a fix roughly 30 days after we were notified of the vulnerability. In that time, we released patches for the third-party libraries that we use for Git repository management (libgit2 and LibGit2Sharp), we released patches to three versions of Visual Studio and Team Foundation Server, and we worked with the Git for Windows team to ensure that our fixes were nice and compatible. In order to get the VS and TFS patches out the door, we needed all of this time. (In fact, we discovered additional vulnerabilities on Mac OS very late in the process. Had these problems affected Windows, too, we would have needed to throw our patches away and start over with the build / test validation process.) And compared to Windows, Visual Studio is not nearly as big or complex, and can turn these changes around faster.