Discussion

• @jaredhaight Jared Haight on x

  This is a great call. It makes a ton of sense to factor in time to patch in your vulnerability disclosure process. https://twitter.com/...

• @campuscodi Catalin Cimpanu on x

  Google's Project Zero team has updated its vulnerability disclosure guideline to add a 30-day patch cushion Per the new rules, once a bug is patched, Project Zero will wait another 30 days before publishing technical details to give users time to patch https://therecord.media/...…

• @clevybencheton Cdric Lvy-Bencheton on x

  This is great but I can already see companies abuse this and not put much effort to patch because they will feel secure for 30 more days. In reality, attackers can reverse the changes in a patch. https://twitter.com/...

• @dakami Dan Kaminsky on x

  I am thankful for all the amazing and necessary research Project Zero provides. https://twitter.com/...

• @steve_tornio Steve Tornio on x

  Might as well tack on another 30 days for the FBI to clean things up, and then users and admins don't need to be involved at all. https://twitter.com/...

• @ryanaraine Ryan Naraine on x

  Google Project Zero finally caved to a lot of heavy-duty pressure https://googleprojectzero.blogspot.com/ ...

• @itswillis Tim Willis on x

  Project Zero's 2021 Disclosure Policy Update. Biggest changes: 1) if a bug is fixed under deadline, the technical details are released 30 days after the fix 2) we're planning to reduce the 90 day deadline starting next year Full post & reasoning here: https://googleprojectzero.bl…

• @anthomsec Andrew Thompson on x

  I applaud the decision to give more time. Separate from that thought, this is an acknowledgment that the way things were being done before wasn't optimal, and that the security community is largely still making it up. That means don't act like this is all figured out. https://twi…

• @campuscodi Catalin Cimpanu on x

  Expect the change to reverberate through the vulnerability research and bug hunting communities, which often use P0 rules as some sort of unofficial guideline

• @arekfurt Brian on x

  From the standpoint of defenders, this is a good and welcome change. All many of them want (well, the responsible ones) is some fair chance to test & patch. The ITW 0day guidelines are still unreasonable though. At least as the 10 day limit applies to non-RCE/non-critical bugs. h…

• @k8em0 Katie Moussouris on x

  “we didn't observe a shift in patch dev timelines, & we continued to receive feedback from vendors they were concerned about publicly releasing tech details about vulns & exploits before most users had installed the patch..the implied timeline for patch adoption wasn't understood…

• @lorenzofb Lorenzo Franceschi-Bicchierai on x

  Interesting changes in the timeline of Google Project Zero's disclosures and deadlines to vendors. https://twitter.com/...

• @thegrugq Thaddeus E. Grugq on x

  Woah... project zero has gone from full disclosure to null disclosure https://twitter.com/...