Hacker News Reader

Comment by user5994461 | Hacker News Reader

> On balance, Project Zero believes that disclosure deadlines are currently the optimal approach for user security

You mean, like when they disclosed the cloudflare vulnerability after about a week and then the web turned into a race to whomever could find older-than-a-week cache with valuable information.

View on HN

They disclosed the cloudflare issue after cloudflare confirmed that the issue was resolved (no additional data was being leaked). The fact that data existed from before then wouldn't have changed at any point for anyone who simply said, "No, we're keeping this random data that could be valuable".

The danger of wider knowledge was significantly eclipsed by the danger of a malicious attacker finding the cached data without public knowledge.

The vast majority of the people scrambling to find an older cache were the owners of those caches, who really didn't want to own data they shouldn't have been sent in the first place.

There was a discussion on this in the report itself; the vulnerability was far too huge for it to go undisclosed for 90 days, I believe.

And it was disclosed after the Cloudflare announcement, IIRC

Basically it was required to be disclosed for it to be "fixed" further. The action that needed to be taken was for everyone to delete their web caches. And everyone can't delete their web caches unless they know about the vulnerability.

Reply on news.ycombinator.com