That's not true. We will withhold disclosure for a reasonable amount of time. 3 days is certainly reasonable.
For locally "sourced" errata, we do handle disclosure a little differently. A fix gets committed. Then a patch gets made. Then an email gets sent. That's about it. What we don't have is a secret cvs branch where we bundle up six or more vulns for disclosure all at once while our premium platinum access partners yank our chain.
Comments
That's not true. We will withhold disclosure for a reasonable amount of time. 3 days is certainly reasonable.
For locally "sourced" errata, we do handle disclosure a little differently. A fix gets committed. Then a patch gets made. Then an email gets sent. That's about it. What we don't have is a secret cvs branch where we bundle up six or more vulns for disclosure all at once while our premium platinum access partners yank our chain.
Ha, I was close on my estimate.