Meaningless distinction, a human designed the bot that pulled the trigger. Building a robot that then murders someone doesn't absolve the designer from the ramifications of what they built.
The meaningful distinction is that a human can be persuaded to extend the deadline, at least in theory. A bot cannot be persuaded to do anything, and if a deadline passes an action is triggered like a dead man's switch. In one scenario, a human needs to maintain the decision to uphold that deadline without bias every single time it comes into question. In the other, they only have to do it once: when the bot is initially designed.
They're different things entirely. Arguing that they're not is like arguing that it's easy to maintain a diet or exercise regimen because you just have to uphold a New Year's resolution for a week. This has important ramifications for a security disclosure deadline, because it (theoretically) reduces bias. There are other elements of a disclosure that can still elicit bias, but at least the deadline time itself will not be one of them.
From headline reading "X goes public with...", most people would infer a scenario where something out of the ordinary is taking place. Pointing out that this disclosure was made by a bot is a meaningful distinction.
This process and the costly signal associated ensures better behaviour from vendors in the long run.
And a human designed the insecure code on IE. That programmer isn't "absolved of the ramifications" of exposing their user base to god-knows-what kind of malware/ransomware.
Not meaningless at all. A better analogy is that you built a robot that pointed a gun at a chair, and said, "this robot will pull the trigger on date X, so don't sit in that chair on date X."
It's not trivial to argue that the robot designer shares the lion's share of the blame here.
The account that posted it, [email protected], is listed[1] as the "owner" of Project Zero, which implies to me that they may be a user account, but quite likely one that has a script running under its permissions.
There certainly could be a human-controlled kill-switch to this release process, of course, and it's possible that "hawkes" manually goes through a list of vulnerabilities every day and clicks "release".
[0] http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 [1] https://bugs.chromium.org/u/1279493906/
The one who didn't expect it to miss the deadline is the same as the person who originally reported the vulnerability. It is therefore a safe assumption that this person understands the disclosure process involved.
Furthermore it is a safe bet that the bug is exploitable. I'm sure that the black market will shortly have people using it.
is it a human or a bot?
> I will not make any further comments on exploitability, at least not until the bug is fixed. The report has too much info on that as it is (I really didn't expect this one to miss the deadline).
Worth mentioning that "Goes Public" implies there was a human who pulled the trigger; it was a bot:
> This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.
...
> Deadline exceeded -- automatically derestricting