Protip: academic board observed secret and so did vendors. The OpenBSD patch went unnoticed. It was the Infosec community that screwed up.https://twitter.com/marcan42/status/919972354947796993 …
-
The two months do not add to nothing. You should try reading the ISO standards and some prior debate on disclosure.
You should try applying some logic. By your theory extra delay adds nothing, so we might as well never audit anything.
-
-
After all, if 2 months make no difference, nor do 2 centuries, so what's the point of looking for bugs? Nobody will ever find them.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Nope, logic does not work that way, sorry.
-
It actually does. If disclosure delay has zero impact at t+2 months for an arbitrary t=time to bug discovery, then by induction impact is 0.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.