undefined | Better HN

0 pointsSahAssar8y ago0 comments

Private Disclosure does not prevent you from publicly disclosing it after a grace period.

0 comments

What grace period is appropriate for a 0 day root login vulnerability?

This guy is, with all probability, not the first one to have found it.

If there was a vulnerability that allowed anyone to open your car and drive off with it, you wouldn't care if he was the first to find it or not. You'd only care about it getting fixed before anyone else knows about it.

I'm not sure what length grace period is appropriate, though.

cwkoss8y ago

If there was a vulnerability that allowed anyone to open my car, I'd want to known ASAP, because I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

Same applies for Apple. No reason to believe this guy was the first one to find this exploit, we only know he was the first one to publicize it.

1 more reply

greedo8y ago

To be pedantic, this isn't a 0day root login vuln, but a priv escalation vuln.

j / k navigate · click thread line to collapse