Yep, disappointing move by Google.
I wonder if this increases the value of patch diffing results. Because P0 will not disclose what the bugs are for a long time which automatically makes patch diffing more attractive 
https://twitter.com/i0n1c/status/1214621661099646989 …
So the new P0 policy is to disclose details only after 90 days even if vendor releases the patch after 20 days. That means people will wait for 70 days before patching because nobody tells them what the bug exactly is and if it is really worth patching 
-
-
-
According to
@epakskape data from BluehatIL, almost no exploits for a vuln discovered in the 30 days after a patch is available. It doesn’t extend to what the average timeline is for the cases that see an exploit. Obviously we don’t have perfect info, just a data point. - Još 13 drugih odgovora
Novi razgovor -
-
-
Yeah, in the short term that's possibly true. The long-term goal though is to reduce the total time for users to receive a high quality patch on their device, which should ultimately reduce the viability of patch diffing for 1-day. If it doesn't work, we'll rebalance the policy.
-
While I respect the rationale behind the new policy and the decision to put it under a test period, I personally think that this will give offensive parties a huge advantage 1/2
- Još 1 odgovor
Novi razgovor -
-
-
Yeah it definitely increases the value of patch diffing to malicious attackers!!! Because it’s in their best interest to check out the changes in a patch to figure out what the vulnerabilities were and exploit them before the patch & bug info gets widely disseminated!!! Yikes…
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Security Through Obscurity has always worked out sooooo well in the past, why not make it the Defacto Standard for Software Security!!!! SMH!!!
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.