Hacker News Reader

Sure. My earlier point:

> A longstanding policy doesn't make it a good one.

If this was a disclosure by the books, there would've been broader, less overtly promotional mitigations discussed.

Project zero would be better off reformulating its disclosure policy here if credibility is what they're going for. Sometimes it's healthier to admit being wrong.

View on HN

While it might assuage some kneejerk skepticism like this, I don't think they're obligated to omit that Chrome has mitigations in place when disclosing a vulnerability.

You're absolutely right. I'd rather have preferred a few different responses, such as including multiple mitigating strategies, even if they're user actions such as browsing only trusted sites until a patch is released.

That said, even if the wording was "Browsers such as Chrome which block win32k.sys system calls using the Win32k lockdown mitigation on Windows 10 prevent exploitation of this sandbox escape vulnerability," I would've given them a partial pass.

Reply on news.ycombinator.com