2 ms·
Microsoft's patch schedule was going to be 32 days later. The hard stance produced a positive outcome here; the patch was available a full month earlier than it
by cheald 12y ago
Microsoft's patch schedule was going to be 32 days later. The hard stance produced a positive outcome here; the patch was available a full month earlier than it otherwise would have been. There is a lot of history between security researchers and big vendors, where the big vendor just delays and delays and delays while the bug is running around out in the wild.
I really do hear what you're saying, and while I'm sympathetic to it, I think that it's much more likely that the Project Zero team adopted the 90-day policy specifically because of years and years of vendors playing push-the-deadline. If there was an industry history of vendors acting promptly in good faith, this wouldn't even be a thing, but the politics behind bug reporting and disclosure are really pretty mature at this point, and I really do think it's naive to just chalk it up to "Google wants to embarrass its competition and is playing dirty to do it".