4 ms·

As a term, it's prone to confusion. Many use 'zero-day' to refer to vulnerabilities that are publicly-known before a patch is available. That is, the figurative

by gojomo 12y ago

As a term, it's prone to confusion. Many use 'zero-day' to refer to vulnerabilities that are publicly-known before a patch is available. That is, the figurative 'zero day' counter starts from public disclosure, not disclosure-to-vendor. Because bugs can't be fixed in zero time, and most readers are interested in the practical matter of whether there is a window of unpatched widespread vulnerability, this public-disclosure-focused definition may in fact be more useful.

cheald 12y ago
> vulnerabilities that are publicly-known before a patch is available We already have a term for that, though: "unpatched vulnerabilities". Using the term "zero-day" erroneously communicates to the reader that Google surprised Apple et al with this thing out of the blue, and just handed crackers the tools to start exploiting it without giving Apple time to develop countermeasures.
- gojomo 12y ago
  Indeed, but it was also an 'unpatched vulnerability' for the last 90 days. And, it was even plausibly an 'unpatched vulnerability' before it was discovered! What's special about today, with an exploit being widely-known but no patch available? That's the new situation people are grasping for a term to describe. 'Zero-day' somewhat fits, at least from the perspective of everyone outside Apple: OSX users and those potentially attacking them. It's a brand-new green-field risk/attack for them! It's also somewhat problematic, for the reasons you list and others. There may be a better term yet to be discovered, that maintains the special distinction for vulnerabilities that the vendor only learns about simultaneous with exploit-availability. But still a lot of people use and understand the term to apply to the window-of-danger from unpatched "Project Zero" 90-day reveals.
spyder 12y ago
I don't think 'zero-day' has anything to do with public knowledge. A hacker can find a vulnerability and exploit it without publicly revealing it and it would be still a zero-day, because the vendor had zero days to fix it.
- wilsynet 12y ago
  It's a stupid term. For the warez scene it makes sense, because a 0 day license exploit has the hallmark of having been available on day 0 for all time. Using 0 day to refer to "days since disclosure to vendor", well, it becomes a 1-day on the very next day. Which means you can only use the term on one day out of all time. If we used 0 day to refer to "days since release", as in "iOS 8 was released today and there's already an exploit" then that would be meaningful.
dingaling 12y ago
> That is, the figurative 'zero day' counter starts from public disclosure, not disclosure-to-vendor. And which derives from its original usage in the late 1990s warez scene. A 0-day licensing crack was one available on the same day a new product hit the market. Many reputations were built on achieving this.

by gojomo 12y ago

cheald 12y ago

> vulnerabilities that are publicly-known before a patch is available We already have a term for that, though: "unpatched vulnerabilities". Using the term "zero-day" erroneously communicates to the reader that Google surprised Apple et al with this thing out of the blue, and just handed crackers the tools to start exploiting it without giving Apple time to develop countermeasures.

gojomo 12y ago
Indeed, but it was also an 'unpatched vulnerability' for the last 90 days. And, it was even plausibly an 'unpatched vulnerability' before it was discovered! What's special about today, with an exploit being widely-known but no patch available? That's the new situation people are grasping for a term to describe. 'Zero-day' somewhat fits, at least from the perspective of everyone outside Apple: OSX users and those potentially attacking them. It's a brand-new green-field risk/attack for them! It's also somewhat problematic, for the reasons you list and others. There may be a better term yet to be discovered, that maintains the special distinction for vulnerabilities that the vendor only learns about simultaneous with exploit-availability. But still a lot of people use and understand the term to apply to the window-of-danger from unpatched "Project Zero" 90-day reveals.

spyder 12y ago

I don't think 'zero-day' has anything to do with public knowledge. A hacker can find a vulnerability and exploit it without publicly revealing it and it would be still a zero-day, because the vendor had zero days to fix it.

wilsynet 12y ago
It's a stupid term. For the warez scene it makes sense, because a 0 day license exploit has the hallmark of having been available on day 0 for all time. Using 0 day to refer to "days since disclosure to vendor", well, it becomes a 1-day on the very next day. Which means you can only use the term on one day out of all time. If we used 0 day to refer to "days since release", as in "iOS 8 was released today and there's already an exploit" then that would be meaningful.

dingaling 12y ago

> That is, the figurative 'zero day' counter starts from public disclosure, not disclosure-to-vendor. And which derives from its original usage in the late 1990s warez scene. A 0-day licensing crack was one available on the same day a new product hit the market. Many reputations were built on achieving this.