Google posts Windows 8.1 vulnerability after 90 days

Sorry, but this is on the vendors. Saying Google shouldn't release details is like saying the public shouldn't be informed of a dangerous flaw in a car model's brake system until the manufacturer has decided whether to launch a new model and what the marketing plan for it should be.

The practice of a firm 90-day release schedule increases the probability that vendors will fix patches and take steps to assure that they are deployed to most devices within that period. But that only works if the practice is firm.

But even if they did, that still isn't a "questionable practice" - if the full details of the exploit are public, you'd barely need a writeup to connect the dots.

> Even if patches were available, it would be far better to wait for most devices to be patched before releasing a full exploit.

So, for router exploits (say), that would be Infinity? If the manufacturer doesn't care, or the update ecosystem is broken (or nonexistent), nobody is more secure because someone did a writeup about a vuln that everyone (..interested) knows about.

Most exploits, however complex their discovery process may have been, end up as "send these bytes in this order" - they are usually very simple to duplicate once you know where the bodies are buried.

[1] As the GP says, 90 days is responsible disclosure.

Yours is the standard argument against any form of disclosure. I'm not discounting it, because no disclosure has its merits, but responsible disclosure satisfies both an ethical imperative (you can't let people believe they're secure if you know otherwise) and provides pressure on vendors to fix their software, when the vendor might otherwise deem it not worth the time or money to fix the issue, which leaves their customers vulnerable.

The basic idea behind disclosure is "we might not be the first people to find this, and we definitely won't be the last, so let's remove all doubt and rob the bad guys of the element of surprise". Responsible disclosure is intended to permit responsible vendors to fix the issue before wide publication, but an uncooperative vendor doesn't mitigate the reality that the bug exists and will eventually be found by someone less benevolent.

I suppose that you will provide sources for that, don't you?

With the set up of Windows servers I've seen, only the admin logs in anyway. It's not really used as a "multi-user" system per-se, where you get different users logging in at the same time. It does happen, but it's not common.