AVG: “Web TuneUP” extension multiple critical vulnerabilities

Re:AVG: “Web TuneUP” extension multiple critical vulnerabili... by tptacek on Monday December 28, 2015 @09:02PM (#10804725)

I'm suggesting that the implication you're generating all over this thread that (a) there are hard-and-fast rules for disclosure and (b) Tavis Ormandy has somehow broken them is probably built on something other than firsthand knowledge of how vulnerability research works --- to say nothing of firsthand knowledge of how this particular vulnerability was handled.

[ Parent | on HN ]

Re:AVG: “Web TuneUP” extension multiple critical vulnerabili... by ikeboy on Monday December 28, 2015 @09:12PM (#10804754)

Google does have a policy not to release within 90 days unless a patch is released, and this does seem to be pointing out a vulnerability that hasn't been patched. What am I getting wrong? Am I misunderstanding something?

Separately, even if they had no such policy or it was an independent researcher, I don't think discussing the ethics of disclosure should be off bounds by someone not directly involved.

[ Parent | on HN ]