[rixrax]

I used to think that 90 days is quite unfair. And in many ways it can be. But it’s a great equalizer. And that way no one company can claim that some other company got preferential treatment. And everyone by now knows that that’s what it’s going to be. Instead of p0 team having to have a fruitless back and forth with vendors about the impact and what would be a reasonable timeline for disclosure.

[rat9988]

90 days is equality but not equity. Not all bugs can be fixed in the same way. Moreover, 90 days seems arbitrary to me, unless there was some prior study behind this number.

[Kalium]

You're absolutely right! 90 days does seem incredibly arbitrary, like it was chosen for political reasons. And this policy is definitely equal, but wildly inequitable.

Is it perhaps possible that equitable treatments of vulnerabilities and companies might not be particularly high on the list of priorities for GPZ? Some might even argue that past attempts at equitable treatment have backfired badly, with many cases of companies abusing the time this gets them to not fix vulnerabilities.

Again, you're completely correct. Though I would genuinely love to hear your ideas of what equitable policy would look like - it could easily be better!

[saagarjha]

It’s just a number that Google Project Zero has decided is what they’re going to hold companies to.

[zepto]

‘Holding them to’ makes it sound like Google has some kind of moral authority here.

I understand the positive incentives for publishing when companies do not respond to flaws.

However Google has no particular right to police other companies.

If they disclose at 90 days, and harm ensues, there is no defense. Google is responsible.

[henryfjordan]

Google has the responsibility to inform users that the software they are using has known vulnerabilities as much as they have a responsibility to disclose them quietly to the software vendors that can fix them.

The way you laid things out, Google should just collect zero-days and sit on them? Do you see the absurdity of that? From a business perspective, having these vulnerabilities around makes it easer for their competitors to collect the same kinds of data about internet search and private emails from people around the internet that Google collects from legit means. Getting vulnerabilities fixes widens Google's data moat.

Disclosing issues is not "policing". They are not arresting people, or taking any action other than stating the truth, that some software is vulnerable.

If they disclose at 90 days and harm ensues, the user bears responsibility for continuing to use the software. If they trust the software vendor to issue timely updates, then they can turn around and lay blame at the vendor for not fixing the issue. Or they can blame the hacker.

[zepto]

Preferential treatment is irrelevant. If harm is done due to the public disclosure, Google is the cause.