Project Zero will disclose vulnerabilities 90 days after reporting

(projectzero.google)

162 points by hacb14 hours ago

6 comments

my-huge-pony8 hours ago
Starting today, our policy is “Full 90”, i.e. vulnerabilities will be disclosed 90 days after they are reported to the vendor.On February 2, 2027, we will move to a “Full 60” policy where vulnerabilities are disclosed after 60 days.On January 3, 2028, we will move to a “Full 30” policy where vulnerabilities are disclosed after 30 days.
- Wowfunhappy19 minutes ago
 WTF with a 30 days deadline in 2028?I thought they made a strong case for removing the additional 30 day patch rollout time. But reducing the entire process to 30 days total seems needlessly harsh and I didn't think it was justified by the article at all. What if the bug is actually inherently hard to fix?
 - fn-mote4 minutes ago
 They expect that in another year LLM-assisted fixing will be the norm. It probably is already.The article says they are willing to negotiate in exceptional cases, and mentions Spectre.
 - doodlesdev7 minutes ago
 <pre><code> > What if the bug is actually inherently hard to fix? </code></pre> Then users might just as well know about it so they can avoid the software while it's vulnerable.
- ares6235 hours ago
 Perhaps eventually, they can finally live up to their namesake. On January 1 2029, we will move to a "Full 0" policy where vulnerabilities are disclosed after (looks at camera) zero days.
 - InsidiousWombat55 minutes ago
 IMO the disclosure should ~day-two after there is a fix/workaround availableReleasing before that is non-actionable by many actors (aside from taking the service completely down I guess). Any time after fix is available is just allowing vulnerable systems to be attacked and is playing favourites with who gets fix and who doesn't
 - habitue19 minutes ago
 So you're saying:2 days after there's a fix, with a max of 90 days after disclosure?Because you still need to have the 90 days no matter what to induce the vendor to create a fix. Otherwise (many) just sit on it forever.
 - fn-mote1 minute ago
 > you still need to have the 90 days no matter what to induce the vendor to create a fixYou’re replying in a thread whose top level comment is that the 90 days will rapidly decrease to 30.Hope 30 is enough to induce them to fix.Maybe the future fixes will be “Reddit + Claude”, done at home.
 - esafak5 hours ago
 If AI is doing all the work I could see that; same day remediation.
 - newAccount20251 hour ago
 AI is not doing all the work.
 - LoganDark1 hour ago
 Do we even know what AI will be doing in two years?
 - nextaccountic3 hours ago
 Which means developers must trust AI blindly since there is no time to review the fix. Which also means that developers are completely unneeded
 - perching_aix2 hours ago
 No, that's not what it means. It just means that the benefit must outweigh the risk, as always. Making surgical patches to existing code is also quite different to introducing features, which is what developers typically spend their time on. Not that same-day patching would imply literally zero time to review either.
 - esafak3 hours ago
 That does not follow. Somebody stills needs to set it up. And maybe to sign off. The AI could instantly diagnose and summarize the problem and its remediation and you say the word.
 jagged-chisel2 hours ago
 And someone who understands the whole thing needs time to validate that the remediation is indeed what it's supposed to be.
 TeMPOraL2 hours ago
 No, they're not - they can just release and wait for another vulnerability disclosure. Then the loop between [Vendors] and Project Zero needs no humans in it.
 jagged-chisel6 minutes ago
 And that's how wallets and bank accounts get drained. Future's looking bright.
 vorticalbox2 hours ago
 “Someone” being another AI agent.It’s agents all the way down.
 - ares6235 hours ago
 If AI is doing all the work then why would remediation be needed at all? Why can't the software AI produces be vuln-free if the same AI is used to detect them?
 - IncreasePosts5 hours ago
 Because the people finding the vulns aren't the people running the services.
 thwarted5 hours ago
 Why aren't they? The people running the services can use the AI to find the vulnerabilities before they release.
 Catloafdev3 hours ago
 You talk as though there is one AI model that is perfect and capable of identifying all potential flaws with no mistakes or omissions, and that access is free and unlimited.Reality is more complicated than that.
 ares6234 hours ago
 Exactly. That's super irresponsible to knowingly release software that you haven't used AI to check if it had any vulns. There's zero (heh) excuse to release vulnerable software at that point.
 canibalrex2 hours ago
 Catching lots of bugs in software written with poor methodology is the new norm and that is not the same as releasing software that is not vulnerable. That is releasing software that needs increasing technological improvements or luck to find remaining vulnerabilities.
 - unsloppable4 hours ago
 Is the AI in the room with you right now?
 TeMPOraL2 hours ago
 The Machine is everywhere. Watching us with ten thousand eyes. Listening with a million ears.
wewewedxfgdf2 hours ago
Ubuntu will need a LOT more time than that.
- dannyw1 hour ago
 After seeing the latest vuln response times by Ubuntu, I switched my main PC to Debian; and will progressively migrate my homelab as I have time.Definitely much happier. There’s nothing I miss from Ubuntu.
 - InsidiousWombat55 minutes ago
 Ubuntu is one thing (and is crazy it took so long) but RHEL somehow failed on that too.
glitchc1 hour ago
It makes to hold out for disclosure if there's a pay day involved. Since this is Google, the bug bounty is not the issue. I say release right away. Nothing else will compel the company being reported on to fix otherwise.
- giancarlostoro14 minutes ago
  You what the whole bottle?
level873 hours ago
Unrelated, but didn't realise .google was a TLD.
- DaSHacka3 hours ago
 Actually many brands pay for their own TLD, though most go unused (publicly).<a href="https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains#Brand_and_corporate_top-level_domains" rel="nofollow">https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...</a>
- mindwok3 hours ago
 There's lots of them now. Companies can apply to have their own for a few hundred thousand dollars.
- varun_ch2 hours ago
 so are .ads, .android, .cal, .chrome, .dclk, .docs, .drive, .gbiz, .gle, .gmail, .goog, .google, .guge, .hangout, .map, .meet, .play, .prod, .search,, .youtube, and .グーグル, .谷歌.They are all owned by Google, but registrations are not open to the public.
Frost1x4 hours ago
I’m not familiar with this specific effort but it seems like the companies digging around for the bugs should also offer similar access to their products that discovered the vulnerabilities to the vendors or OSS projects to patch them. Otherwise vendors might use this as a leveraged approach to get people to adopt LLMs, specifically theirs, so their products remain reasonably attractive. Google, OpenAI, Anthropic etc could just turn on existing software as a strategy to get more adoption of their tools.“Don’t like our constant stream of patches? For $10k/mo + tokens you can get access to the model to patch the vulnerabilities we disclose!”
- Refreeze52244 hours ago
 Project Zero has been around far longer than GenAI or LLMs, so your point is not really relevant here.
 - Frost1x3 hours ago
 How is it irrelevant? Just because an effort existed before some change, doesn’t mean it can be repurposed and leveraged for other purposes. It’s the entire reason law and policy for government isn’t set in stone and is adaptable, because culture, technology and so on change.The dynamic in this context absolutely has changed. Marginal cost to discover vulnerabilities from AI frontier labs and the big players has dropped significantly. The cost to patch is low, if you have access to certain resources. If you don’t, tough luck.So this argument is essentially against the entire argument of AI alignment guardrails right now. Maybe you disagree with those, but I for one am happy they’re doing some things to protect against bio related warfare engineering. This is a case of cyber that’s about grey. Even there the labs have limited access to some and are choosing winners.
- sumeno2 hours ago
 The "product" that finds Project Zero bugs is the people who work for Project Zero.
- darkamaul1 hour ago
 For sure I would love to get access to P0 researchers for a m 10k/months, but i don’t believe you can hire such talent for this sum.They are one of or maybe the most skilled security research team that’s doing public research and their blog is the source of many modern exploitation techniquesFor a while, asking your agent to act like a P0 researcher was a nice nudge to find better bugs !
- ylk3 hours ago
 Usually you can’t find the kind of bugs P0 finds by just throwing AI at it. You need highly skilled people driving/guiding it. Highly skilled people are the bottleneck.In any case it’d be sensible to make yourself familiar with the “specific effort” before you make up your opinion on it.
- InsidiousWombat51 minutes ago
 That's kinda the problem with asinine "safety" idea the AI moguls have.It is just leaving people with less safe software. At least claude the limitations are actively preventing you from looking for security bugs in your own software
- clhodapp3 hours ago
 You say that like it's a bad thing...I mean, sure, the cited $10k / mo is exploitative for small open-source projects but... in general, why wouldn't we want there to be pressure on companies and projects to use high-quality LLM-based checks if they want to see wide adoption?
jamiesonbecker4 hours ago
[flagged]
- Refreeze52244 hours ago
  Nice unsolicited plug for your slop product.