4 ms·
While I agree that that's probably a good measure, I don't think it's feasible. Many exploits are reported privately to the company first, so they have time to
by lucumo 17y ago
While I agree that that's probably a good measure, I don't think it's feasible. Many exploits are reported privately to the company first, so they have time to fix them. After the fact reporting by the company would create an incentive to underestimate the amount of time it took. Finding the reporters may be hard, and even if they are inclined to comment on when they found it, you can't really trust them, since their incentives aren't clear either. They may love the browser, or hate it...
- jacquesm 17y agoThe person that discovered the bug originally would be the authority, not the company.
- lucumo 17y agoYes, but that has problems too, as I pointed out in my previous post: > Finding the reporters may be hard, and even if they are inclined to comment on when they found it, you can't really trust them, since their incentives aren't clear either. They may love the browser, or hate it...
- jacquesm 17y agoThat's a technical problem, nothing more. At the moment of sending off the message to the company you could post your message digest to a secure server somewhere.
- lucumo 17y agoOnly if the reporter wants to go through hoops like that. The more work it is, the less likely they are to want to do that. That's especially so since there's no advantage for them in doing so...