Over the past 6 weeks, there has been a raging debate within the security community over the topic of “when.” I’m referring to the point at which it’s considered acceptable to publically release details regarding vulnerabilities one has discovered in a product after informing the vender who created said product.

The discussion began the first week of June when Google researcher Tavis Ormandy publically published a substantial flaw in the Windows Support module built into the Windows operating system… a mere five days after he informed Microsoft about the exploit.  His rationale was that he felt Microsoft wasn’t taking him seriously, so he decided to force the issue by making it public.  A month later, 25,000+ systems are compromised worldwide because Tavis not only explained the exploit in great detail, but he also published proof of concept code samples for the world to see.  Not surprisingly, the malware that was seen a few days after he went public was directly based upon his proof of concept code.

The debate continues today with sides dividing between Google (who has stated they back Tavis’ decision to publish) and Microsoft (who holds Tavis responsible for the resulting compromised PCs).

This is where the question of “when” comes into the equation… how much time is considered “reasonable” to give developers the ability to address vulnerabilities in code?  Is this a fixed value, do you give less time for a smaller product or perhaps more for a complete operating system?  Considering that Microsoft releases patches on a 30-day cycle (normally the first Tuesday of the month – “Patch Tuesday”), and Tavis informed Microsoft the first week of June, would you have thought it reasonable for Tavis to sit on the information for at least the full patch cycle before going public?  Not only does the exploit need to be researched but the resulting patch needs to be thoroughly tested to see if something else breaks as a result.

So what do you feel is a reasonable answer for “when”?

Was this article helpful?

About Leigh
If RJS employed “The Most Interesting Man in the World,” one could argue our very own Network Security Engineer, Leigh Reimers, just might fit the bill. Leigh is a black-belt karate master and former United States Army tough guy. At RJS, Leigh is a “jack-of-all-trades,” assisting with network administration and support on the off-chance he isn’t solving difficult security conundrums as a certified Sophos Advanced Sales and Technology Engineer.