Hacker News Reader

Comment by mcv | Hacker News Reader

Can someone explain to me what "zero day" still means these days? I thought it was the time the developer was aware of the vulnerability, so once they're patching it or deciding not to patch it, it's by definition not a zero-day exploit anymore, isn't it?

Or do I understand this completely wrong?

View on HN

I've always interpreted it as meaning no patch is available yet for a vulnerability. Does not matter whether a decision to patch or not has been made. Doesn't matter if it's been exploited yet.

I've always interpreted it as "zero days since a fix was released."

Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported.

It's shorthand for "an exploit that wasn't responsibly reported".

Yes, it has essentially lost all meaning as most vulns are exploited before ever being reported. And even those who responsibly report them call them “0-days”, which is sort of true on the day they report them, but only if the company didn’t receive any other reports, and why would they divulge that information unless they had to, like to give someone else the bug bounty? “Sorry, it’s actually a 14-day, we’re working on the fix.” Right.

So again, it’s lost any useful meaning I think.

> as most vulns are exploited before ever being reported.

I don't think that's even remotely true.

And given that it's not true, it's still a useful distinction. 0-day means an exploit that is being exploited before it was reported to the vendor, which is different than most exploits, which are reported to the vendor first.

I guess it's true that most vulns are either reported to (or originate from) a vendor, and that these dominate the CVE db.

But naturally, unless you are the vendor, you will likely not have heard of these. Otherwise, by definition, they would be zero-day vulns.

> Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported.

Any vulnerability that was reported and not fixed could probably be considered one?

Or any unfixed one for that matter (any widely exploitable vulnerability).

Reply on news.ycombinator.com