Googler Drops Windows Zero-Day, Microsoft Unhappy

Re:Googler Drops Windows Zero-Day, Microsoft Unhappy by ghshephard on Thursday June 10, 2010 @09:10PM (#1422384)

Are you trying to argue that, for a "reliable Windows remote" that:

  A) Security Researchers should not disclose 
      vulnerabilities.

  B) Security Researchers should not disclose 
     vulnerabilities before the vendor has a 
     chance to patch them.

  C) Security Researchers should aggressively 
     disclose on a 30-60 day time frame.

  D) Security Researchers should disclose within a week.

I'll presuppose that your answer will be "E - it depends" - so let's restrict it to this _particular_ vulnerability.

My answer is C), but only because I realize that the squeaky wheel _really_ gets the grease, and that the threat of disclosure really, really inspires developers to Lab, Replicate, Solve, and deploy a fix. My answer is not D), because I believe more harm is done by disclosing vulnerabilities where there is _no chance_ of a patch being completed in time. Tavis Ormandy clearly believed the answer was D) in this case.

Also, of all vendors, Microsoft is actually pretty good (not perfect) about getting regular security patches out on a monthly basis - I'd have to believe that they probably prioritized this one fairly high.

[ Parent | on HN ]

Re:Googler Drops Windows Zero-Day, Microsoft Unhappy by daten on Thursday June 10, 2010 @10:11PM (#1422503)

Microsoft releases security updates on a regular schedule, but that doesn't tell us how long the turnaround is from a vulnerability being reported to a fix for that vulnerability being released. It could be reported today and not fixed for 10 patch cycles, it will still look like Microsoft is doing something. I think the turnaround is more relevant to the point that just how often patches are released.

[ Parent | on HN ]

Re:Googler Drops Windows Zero-Day, Microsoft Unhappy by tptacek on Thursday June 10, 2010 @09:16PM (#1422392)

If I was doing independent work on Microsoft or Google code, I'd pick (B).

I think the world would be a better place if everyone would do (D).

I agree with you about Microsoft.

[ Parent | on HN ]