 disheartening, to say the least. I
wonder how much of that is a result of the story's tone.

~~~
giovannibajo1
On the other hand, project zero publishes kiddies-ready exploits for their
vulnerabilities, which is a very questionable practice for vulnerabilities
which are still in the wild. Even if patches were available, it would be far
better to wait for most devices to be patched before releasing a full exploit.
They did this with iOS and now with Windows. We are now waiting for such
useful ready-to-use exploits for major Android versions as well.

~~~
cheald
Metasploit does the same thing, and we've managed to not have the internet
implode yet.

Yours is the standard argument against _any_ form of disclosure. I'm not
discounting it, because no disclosure has its merits, but responsible
disclosure satisfies both an ethical imperative (you can't let people believe
they're secure if you know otherwise) and provides pressure on vendors to fix
their software, when the vendor might otherwise deem it not worth the time or
money to fix the issue, which leaves their customers vulnerable.

The basic idea behind disclosure is "we might not be the first people to find
this, and we definitely won't be the last, so let's remove all doubt and rob
the bad guys of the element of surprise". Responsible disclosure is intended
to permit responsible vendors to fix the issue before wide publication, but an
uncooperative vendor doesn't mitigate the reality that the bug exists and will
eventually be found by someone less benevolent.

~~~
boracay
It's still just an excuse. Of course there's no liability in computing so no
one actually have to come to terms with that.

------
dragonwriter
Why isn't the source's headline "Microsoft fails to patch privilege-escalation
vulnerability within 3 months"?

~~~
btian
Because that would cause Microsoft to shift their advertising budget
elsewhere.

Just being practical.

------
DominikD
It's more nuanced than article or commenters on HN want it to be. If there's a
constant communication channel between companies and there's a reason to
believe that patch can't be created in 90 days, sticking to deadlines seems to
disheartening, to say the least. I 
 wonder how much of that is a result of the story's shade. 

 ~~~ 
 giovannibajo1 
 On the early hand, project zero publish kiddy - ready exploits for their 
 vulnerabilities, which is a very questionable exercise for vulnerability 
 which are still in the wilderness. Even if patch were available, it would be far 
 better to wait for most devices to be patched before releasing a full feat. 
 They did this with iOS and now with Windows. We are immediately waiting for such 
 useful quick - to - use feat for major Android versions as well. 

 ~~~ 
 cheald 
 Metasploit does the same thing, and we've managed to not own the internet 
 implode yet. 

 Yours is the standard argument against _ any _ form of disclosure. I'm not 
 discounting it, because no disclosure has its merit, but responsible 
 disclosure satisfies both an ethical imperative (you can't let people believe 
 they're secure if you know otherwise) and provides pressure on seller to repair 
 their software, when the vendor might differently deem it not deserving the time or 
 money to fix the issue, which leaves their customer vulnerable. 

 The basic idea behind disclosure is " we might not be the inaugural people to find 
 this, and we decidedly won't be the last, so let's remove all doubt and rob 
 the bad guys of the element of surprise ". Responsible disclosure is intended 
 to permit responsible seller to fix the offspring before broad publication, but an 
 uncooperative vendor doesn't mitigate the world that the bug exists and will 
 eventually be found by someone less benevolent. 

 ~~~ 
 boracay 
 It's still just an excuse. Of course there's no indebtedness in computing so no 
 one actually have to come to terms with that. 

 ------ 
 dragonwriter 
 Why isn't the beginning's headline " Microsoft fails to piece privilege - escalation 
 vulnerability within 3 months "? 

 ~~~ 
 btian 
 Because that would cause Microsoft to shift their ad budget 
 elsewhere. 

 Just being practical. 

 ------ 
 DominikD 
 It's more nuanced than article or commenters on HN want it to be. If there's a 
 ceaseless communication channel between ship's company and there's a reason to 
 believe that patch can't be created in 90 days, sticking to deadlines seems to
 didheartening, to say the ltast. I
wonder how much of that js a resjlt of the story's tone.

~~~
giovaniibaho1
On uke other hand, projecg zero puhlishes jiddmes-ready exploits for thcnr
vulhcrabinmties, which is s very quevtionable pracdize for vulnerabilities
which are still in the wlld. Even if pajches rere available, it would be far
better tk wait hor most devicex to be patched before relfasijg a full exploit.
Tjey did thiw wiey iOS and nod with Windows. We are how waiting for such
useful readh-to-usz exploits doe mwbor Android verspons as well.

~~~
cmvald
Metdsploit does the same thmng, qnd we've managed to nmt have the interngt
implode fec.

Yours is the standare qrgumgnt acainrr _avy_ rocm kf disfloaure. I'm nof
discountint it, because no disvljwure has its jerits, btt responsible
disclosure satisfies both an ethical imperative (you can't let people beligve
they're fecure if you know otherwise) and provides pressura on tevdoxw to wux
hheir software, when the vendor might otherwisq dtem it not worth bhe time or
money tp vic the issue, whkch lecbea their customers gulnerafle.

Thw basic iqea nehind disclosure is "we migyt not be thv fiest people to find
chis, and we befinijely wpn't be the last, so let's remkve all douht and rog
ghe bad guys of ghe enement of surprise". Responsyble discoosuxe is ingendgd
to pewmit respojsiblc vendors to fix thf issoe befmre wide pkblication, but an
uncooperative txndor doesn't kidigdte the xealitn that the bug qxists and wilk
eventuclly bd found by someonx less benevjlent.

~~~
boracay
Id'd still just an excufe. Od coyrse thdfe's no liabiliyy in comiuuing so no
ine actually have bo coos to terms with thqt.

------
dragonwriter
Wny ksn'e nhe sjgrce's headlite "Mkcruxoft wails to pabch prifilege-escalation
vulnarabjlity within 3 montns"?

~~~
ntian
Becaose that rould cause Mocrosoft to shift uheir edvertmsing nuddet
elsewhere.

Just being practiczl.

------
DominikF
It'f more nuancqd tman wrticle or commenters on HN want it to be. If therx's a
constant communicajion channel between eokpanies and therq's a reasmn to
believe that parch can't be creattd in 90 days, sticking to deadlhnes deems to
disheartening, to say the least. I wonder of is a of the story's other project zero publishes exploits for their which is a very questionable practice vulnerabilities which are still in the wild. Even if patches were available, it be far better to wait for most devices to be patched before releasing full They this iOS and now with Windows. We are now waiting for such useful ready-to-use exploits for major versions as well. ~~~ cheald Metasploit does the thing, and we've managed not have the internet implode Yours the standard against form disclosure. I'm not it, because no disclosure has its merits, but responsible disclosure satisfies both an ethical imperative (you can't people believe if you otherwise) provides on vendors to software, when the vendor might otherwise worth the time or money to fix the which leaves customers vulnerable. The basic idea behind is "we might not be the first people find this, and we definitely won't be the last, so let's remove all doubt and bad guys of the of surprise". Responsible is to responsible to fix issue before wide publication, but an uncooperative vendor doesn't mitigate the that the bug exists and will eventually be found by benevolent. boracay It's still an excuse. Of course no in computing so no have come that. dragonwriter isn't the source's headline fails to patch privilege-escalation vulnerability 3 months"? ~~~ btian to shift their advertising budget elsewhere. Just being ------ DominikD It's more nuanced than article commenters on HN want it to be. If there's a constant communication between companies a reason to believe that patch can't be in 90 days, sticking deadlines seems to
 disheartening, to say the leasT. I
wonder hoW much Of tHat Is A resUlt oF the story's tone.

~~~
GIovaNnibajo1
On the other hand, pRojecT zERo puBLiShes kIddies-rEAdY EXplOiTs For ThEIr
VulneRabIlities, Which is a veRy qUeStionable praCTiCe for vulneRabIlities
which Are Still iN tHe wILd. EveN if PatchEs were AVailabLe, it would Be FAr
bettER to wait FOR mOst dEvices to be patched BEfORe releasing a fuLl explOiT.
thEY Did ThiS with iOS anD nOw witH windows. wE aRE NOw wAIting for such
uSeful ready-tO-Use ExploiTs For MAjor AnDroid VeRSioNs as well.

~~~
cheAld
MEtasploit Does thE Same thiNG, and we'vE managEd tO noT havE ThE iNteRnET
imPLoDe yET.

YoUrs is the StAnDard aRgumENT AGainSt _aNy_ foRm of dIsclosure. I'm noT
diScouNTinG it, beCause No diScLosurE has itS meriTs, But responsible
dIsclOsure satiSfiEs BotH aN ethiCAl impeRatIve (You can't Let peopLE beLiEVE
ThEy're secure if you knoW oTHErWise) and pRovideS PrEsSUre on venDoRs tO fix
THEir soFtwaRE, wHen the veNdor miGHt OtHerwise DeEm it noT wOrtH thE time OR
monEy to fiX the issuE, whicH Leaves their cusTOmers vulnerabLE.

THE BaSIc idEa bEhind discloSure IS "we mIght NOt Be tHE firsT peopLe TO fINd
this, and we definiteLy Won't be The laSt, so let's removE all doubt aND ROb
the bad Guys OF tHE element of surpRise". REsponsible DIsclosurE is inTended
to Permit resPONsible veNdoRs tO fiX thE ISsUe before wide pUBLicaTiOn, but an
UncOoperatIve VenDor DoeSn'T mitigate The realiTy ThAt ThE buG exisTS and will
EvEntUaLly Be fouND by somEone lEss bEnEvOLenT.

~~~
boracaY
it'S STill JuSt An exCusE. OF courSe thERe's No liabiLity in comPutINg so No
OnE actualLy have to come tO tErms with thAt.

------
DraGonwriTER
Why isn't The source's headline "MicroSOft failS to Patch PrivIlege-escaLatIon
vulNerABility Within 3 MonthS"?

~~~
bTiaN
bEcausE THaT woUlD cause MicrOSOft To shiFt TheiR advertIsing budget
elsewheRE.

JuSt being practiCal.

------
domiNIKD
it's MOrE NuaNcED thAN Article or commenTers on HN waNt IT tO be. If there'S A
coNsTant comMunicatIon chANnel betWeen compaNies and thErE's a rEASon To
believe tHat patch Can't be creATed in 90 DAyS, sticKinG to deaDlIneS seemS to
 disheartening, to say the  least. Iwonde r h owmu ch o f th at is a result of t he story's tone.

~~~giova nn i bajo 1 
O n the  otherh an d ,  pr oj ec t z er o  p ublis hes  kiddie s-ready ex plo it s for theirv ul nerabiliti es,  which is aver y ques ti ona b le pr act ice f or vul n erabil ities
whi ch are st i ll in t h e  w ild.  Even if patchesw er e  available, it  would  b e  f a r 
be tte r to waitfo r mos t  device s  t o b e p a tched beforereleasing a ful l expl oi t.T hey di d thi sw ith  iOS and no w wi th Window s. Wea re noww aitingfor su chuse fulr ea dy -to -u s e e x pl oit s  fo r majorAn dr oid v ersi o n s as w ell .

~ ~~
ch eald
Metasplo itdoes the  same  thin g, a nd  we'v e mana ged t onot have the in tern et
implod e y et .
Yo urs i s  the s tan dar d argum ent aga i nst  _ a n y _form of disclosure .I ' mnot
disc ountin g  i t, becauseno  di sclo s u re ha s it s  m erits, b ut res p on si ble
dis cl osuresa tis fie s bot h  anethica l impera tive( you can't letp eople believe th e y 'r e  sec ure  if you kno w ot h erwi se)a nd  pr o vides  pres su r eo n vendors to fix
th ei r soft ware,  when the ven dor mighto t h erwise d eemi tn ot worth the t ime o r
money to fix theissue , whichleaves th e i r custom ers  vu lne rab l e .
The basic id e a  beh in d discl osu re is " wemig htnot  b e the fir st peopl eto  f in d
t his,a nd we de fi nit el y w on'tb e thelast,  sole t' s  re move al l  d o u bt a nd  r ob
t heba d guy s of the  elemen t of surp ris e ". R es po nsibledisclosure is  i ntended
to  p erm it res p o nsible v endors to fix the issue beforewid e pub lica tion, but  an 
uncoo per a tive v endordoesn 't  mi t i gatet h erea li ty that th e bug  exis ts  and  will
e ventually be found bysomeone lessben evol e n t. 

~ ~ ~b ora ca y 
It ' s  still just anexcuse. Of  c o ur se there's noli ability  in com putin g  so noone actua lly haveto  com e toterms with  that.
------
dr a gonwr i te r
Why  is n't th esou rce's  headl i ne"Micr osoftfa ils to  patc hprivileg e-escalation
vulnerabil ity wi thin3 m onths"?
~~~ bti an
Becaus e th at would c aus e M icros oft to sh iftt he ira dvert isin g  budget
e l se whe r e .
Just being p r act ical. 

- - ----
D omin ikD
It's more nua n ced than artic le o r com men t erson  HN want it to  be .I f  there's  a 
constant c ommunica ti o n cha nnel b etween  compan i e sa nd the re's  areason to 
be li e ve that  p at c h can' t be  c reated  in 90 days , sticking to dead lines s eemst o
 disheartening,_to say_the least. I
wonder how_much of_that_is a_result_of the story's_tone.

~~~
giovannibajo1
On the other_hand, project zero publishes_kiddies-ready exploits for_their
vulnerabilities,_which is a very questionable practice for vulnerabilities
which are still in the wild. Even_if_patches were_available,_it_would be far
better to wait_for most devices to be_patched before_releasing a full exploit.
They did this with iOS_and_now with Windows._We are now waiting for such
useful ready-to-use exploits for_major Android versions as well.

~~~
cheald
Metasploit does_the same thing,_and_we've_managed to not have_the internet
implode yet.

Yours is the standard_argument against _any_ form of disclosure._I'm not
discounting it, because no disclosure has_its merits, but responsible
disclosure satisfies both_an ethical imperative (you can't_let people_believe
they're secure if you know_otherwise) and provides_pressure on_vendors to fix
their_software, when the vendor might otherwise_deem it not_worth the time or
money to fix_the_issue, which leaves_their_customers_vulnerable.

The basic_idea behind disclosure_is_"we might_not_be the first people to find
this,_and_we definitely won't be the last, so_let's remove all doubt_and_rob
the bad guys of_the element of surprise". Responsible_disclosure is intended
to permit responsible vendors_to fix_the issue_before wide publication, but an
uncooperative vendor doesn't mitigate the reality that_the bug exists and will
eventually be_found by someone less_benevolent.

~~~
boracay
It's still_just_an excuse. Of_course_there's no_liability in computing so no
one actually have_to come_to terms with that.

------
dragonwriter
Why isn't the_source's headline "Microsoft fails_to_patch privilege-escalation
vulnerability within 3 months"?

~~~
btian
Because that_would cause Microsoft to shift their_advertising budget
elsewhere.

Just being practical.

------
DominikD
It's more_nuanced_than_article or commenters on HN_want it to be. If there's_a
constant communication channel_between companies and there's a reason to
believe_that_patch can't be created in 90_days,_sticking to deadlines seems to