← Back to context

Comment by EricE

4 years ago

The best way to get vendors to make security a priority is to not perpetually coddle them. At this point in time if a vendor cant react to something in under a month in a half that's more on them than the rest of us.

If anything the security community should be steadily decreasing the amount of embargo time. I wouldn't be opposed to different classes/criticality of vulnerabilities having different timelines. But for vulnerabilities where everyone's collective ass is proverbially hanging out there the times should be VERY short.