For the sake of the argument, which organizations do you know that would make the conscious decision to actively delaying patching because they don't know the details of a bug, once a patch is available? Or are you thinking end consumers, even?
So the new P0 policy is to disclose details only after 90 days even if vendor releases the patch after 20 days. That means people will wait for 70 days before patching because nobody tells them what the bug exactly is and if it is really worth patching 
-
-
-
Well, Google prioritises releasing patches from qualification based on available public information, so there's one example
- Još 10 drugih odgovora
Novi razgovor -
-
-
That’s Complete Insanity!!! So then remotely exploitable bugs will remain vulnerable for 2+ months after being patched??? So because no one is going to find out about the bugs for 90 days, then malicious attackers have a wide open attack window of 2-3 months??? Wow, just wow!!!
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.