Hacker News Reader

Given that Microsoft had excellent reason to ask for an extra 2 days, I guess the real question is that for a data-driven organization, why Google think 90 days is such a good number in the first place, and why they insisted on sticking to it despite the asinine alternative (forcing tens of thousands of IT departments to coordinate an out of band change for a low severity bug).

A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process.

Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?

Even so, this is a clash of two policies and Google needs to reevaluate its deadline (is 120 days better for everyone, including users?).

This looks like a solution, but isn't. Perhaps Google's 90 day deadline is already a re-evaluation of a 60-day deadline that was made to accommodate holidays and companies with a once-a-month patch schedule. If Google's deadline was 120 and still hit two days before patch Tuesday, would you say the same thing but for 150?

(N.B. I'm not defending Google, just poking a hole in this particular idea.)