Google Project Zero revises 90-day disclosure rules

guest · Jan 7, 2020

Yeah, says Google Project Zero, when you think about it, going public with exploit deets immediately after a patch is emitted isn't such a great idea
The Chocolate Factory's bug hunters revise 90-day disclosure rules
January 7, 2020
https://www.theregister.co.uk/2020/01/07/google_project_zero/

Patting itself on its back for motivating software makers to fix 97.7 per cent of the vulnerabilities it identifies within its 90-day disclosure deadline, Google's bug-hunting unit Project Zero has decided to ease up on those racing to patch their flawed products.

This month, Project Zero revised its Disclosure Policy so that it will publicly reveal details of a security flaw precisely 90 days after privately disclosing the details to the relevant vendor. This is a change from the previous policy under which bugs were revealed after 90 days or when fixed, whichever came first.

As a result of the amended policy, vulnerability details will remain undisclosed for a longer period of time, giving developers enough time to fix their code, and netizens to test and install the patches, before Googlers make technical details and proof-of-concept exploits public for all to see.
There are also other exceptions: vendors can request an additional 14-day grace period [...]
Click to expand...

Google Project Zero: Policy and Disclosure: 2020 Edition

Summary of changes for 2020
For vulnerabilities reported starting January 1, 2020, we are changing our Disclosure Policy: Full 90 days by default, regardless of when the bug is fixed.

Fix a bug in 20 days? We will release all details on Day 90.
Fix a bug in 90 days? We will release all details on Day 90.

If there is mutual agreement between the vendor and Project Zero, bug reports can be opened to the public before 90 days elapse.
We will try this policy for 12 months, and then consider whether to change it long term.
Click to expand...

Log in or Sign up

Google Project Zero revises 90-day disclosure rules

guest Guest

Log in or Sign up

Google Project Zero revises 90-day disclosure rules

guest Guest

Useful Searches