Google Goes Public with Unpatched Microsoft Edge and IE Vulnerability

Re:Google Goes Public with Unpatched Microsoft Edge and IE V... by obstinate on Tuesday February 28, 2017 @12:20PM (#13755434)

I think the person making that comment is confused about how this works. The bug was filed in November. The deadline passed before the comment was made.

[ Parent | on HN ]

Re:Google Goes Public with Unpatched Microsoft Edge and IE V... by rattray on Tuesday February 28, 2017 @12:38PM (#13755606)

The "Deadline exceeded -- automatically derestricting" comment was posted on Feb 23, 90 days[0] after Nov 25.

The account that posted it, [email protected], is listed[1] as the "owner" of Project Zero, which implies to me that they may be a user account, but quite likely one that has a script running under its permissions.

There certainly could be a human-controlled kill-switch to this release process, of course, and it's possible that "hawkes" manually goes through a list of vulnerabilities every day and clicks "release".

[0] http://www.convertunits.com/dates/90/daysfrom/Nov+25,+2016 [1] https://bugs.chromium.org/u/1279493906/

[ Parent | on HN ]

Re:Google Goes Public with Unpatched Microsoft Edge and IE V... by btilly on Tuesday February 28, 2017 @01:18PM (#13756134)

Which person making which comment?

The one who didn't expect it to miss the deadline is the same as the person who originally reported the vulnerability. It is therefore a safe assumption that this person understands the disclosure process involved.

Furthermore it is a safe bet that the bug is exploitable. I'm sure that the black market will shortly have people using it.

[ Parent | on HN ]

Re:Google Goes Public with Unpatched Microsoft Edge and IE V... by obstinate on Tuesday February 28, 2017 @01:38PM (#13756386)

Oops. I misread "(I really didn't expect this one to miss the deadline)" as "I really don't expect . . ." in #5.

[ Parent | on HN ]