4 ms·

This apparently _does_ take that long, but should absolutely not.

• markcerqueira 12y ago
  Right. If they extended it to 180 days, it would take them 200 days to fix it. 365 days ~> 400 days.
• higherpurpose 12y ago
  Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period. If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).
  • teraflop 12y ago
    Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/list?can=1&sort=-id https://code.google.com/p/google-security-research/issues/li... What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed. https://code.google.com/p/google-security-research/issues/detail?id=111 https://code.google.com/p/google-security-research/issues/de... https://code.google.com/p/google-security-research/issues/detail?id=113 https://code.google.com/p/google-security-research/issues/de...
  • Amezarak 12y ago
    There are other bugs not reported by Google that Microsoft has to investigate and resolve as well. I doubt Google is the primary channel of security bug reports.