Re:LastPass release fix for DOM manipulation vulnerability
by kbenson on Saturday April 01, 2017 @04:09PM
(#14013897)
That's one way to look at it. Another way s that they are subsidizing the security team of their competitors.
Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway.
Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money.
Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway.
Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money.
1: https://googleprojectzero.blogspot.com/2015/02/feedback-and-...