Re:Governor vows criminal prosecution of reporter who found ...
by bigiain on Thursday October 14, 2021 @05:53PM
(#28870685)
> but devs can only work so fast, which creates a window of opportunity which damages both them and their users.
Sadly, time and time again, what in practice ends up happening is the window of opportunity is wasted by the devs being instructed to work on new features rather than fix critical security bugs the company thinks are not widely known.
Apple’s response to four zero days being only the most recent high profile example of that.
If one contacts the corrupted major for a timed disclosure, he gets time to hide crimes or can continue being corrupted, but the press running the story only damages the major.
If I run to the press with a vulnerability, everyone is empowered in exploiting it. Sure it puts lots of pressure on the devs, but devs can only work so fast, which creates a window of opportunity which damages both them and their users. A timed disclosure doesn't prevent exploitation that's already happening, but doesn't increase the problem by itself
The desired outcomes in the two cases are different, and it's no surprise different strategies are optimal.