kolliden · Nov 5, 2026
Keep 90 days
3 reasons4 sources
What this position proposes
Researchers keep giving projects 90 days to fix a reported bug before details are published, as Project Zero and most of the industry do today.
Reasons
- 1.
A fixed deadline is what makes vendors fix bugs at all; before it, reported flaws could sit unpatched for years.[1]
- 2.
Almost none of the new AI-found bugs are being exploited, so the flood is no reason to rewrite the rules.[1]
- Source 1: Cisco Talos: There’s only so much code: the rise in vulnerability numbers · blog.talosintelligence.comOpen original
- 3.
Everyone already knows the 90-day rule, so changing it would create confusion exactly when the volume of reports is highest.
Unsourced
Anyone can add a reason, an objection or a source here. You create a free account when you publish. Already have one? Sign in.