Hacker News Reader

Comment by rinon | Hacker News Reader

This apparently _does_ take that long, but should absolutely not.

Either Google is sending Microsoft bug reports like rapid-fire, and Microsoft has already fixed dozens of them that we haven't found out about - or for some strange reason, Microsoft didn't fix the only two bugs Google reported in the last 90 day period.

If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).

Well, Google has been sending Microsoft (and other vendors) lots of other bug reports: https://code.google.com/p/google-security-research/issues/li...

What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed.

https://code.google.com/p/google-security-research/issues/de...

There are other bugs not reported by Google that Microsoft has to investigate and resolve as well. I doubt Google is the primary channel of security bug reports.

Right. If they extended it to 180 days, it would take them 200 days to fix it. 365 days ~> 400 days.

Reply on news.ycombinator.com