Linked by Thom Holwerda on Sat 1st Jun 2013 18:43 UTC
Privacy, Security, Encryption Google is changing its disclosure policy for zero-day exploits - both in their own software as in that of others - from 60 days do 7 days. "Seven days is an aggressive timeline and may be too short for some vendors to update their products, but it should be enough time to publish advice about possible mitigations, such as temporarily disabling a service, restricting access, or contacting the vendor for more information. As a result, after 7 days have elapsed without a patch or advisory, we will support researchers making details available so that users can take steps to protect themselves. By holding ourselves to the same standard, we hope to improve both the state of web security and the coordination of vulnerability management." I support this 100%. It will force notoriously slow-responding companies - let's not mention any names - to be quicker about helping their customers. Google often uncovers vulnerabilities in other people's software (e.g. half of patches fixed on some Microsoft 'patch Tuesdays' are uncovered by Google), so this could have a big impact.
Thread beginning with comment 563509
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[5]: Comment by Nelson
by cfgr on Mon 3rd Jun 2013 12:29 UTC in reply to "RE[4]: Comment by Nelson"
Member since:

Since we are talking about software, most would consider it a software defect which is more commonly known as a bug. Sorry you are being a pedantic dick-piece.

No. A bug would be like a broken design for the car radio. A security vulnerability is like a broken design for the brake system. The former gets fixed at the garage, the latter gets recalled and costs a lot of money to the manufacturer. Ask Toyota how that went, even though ultimately they may not have been at fault.

Also, name calling only decreases any credibility you had left.

Edited 2013-06-03 12:33 UTC

Reply Parent Score: 2

RE[6]: Comment by Nelson
by Nelson on Mon 3rd Jun 2013 13:30 in reply to "RE[5]: Comment by Nelson"
Nelson Member since:

The classic OSNews pile on. Why am I not surprised. Anyway, the differences are well known, and completely irrelevant.

Its obvious what he meant, and nit picking aside, his point still stands. Where as you and JAlexoid have spent time splitting semantic hairs, none of you have addressed the actual real concerns that he raised.

Reply Parent Score: 3