In this commentary, the speaker evaluates Google’s Project Zero shift from a strict 90‑day vulnerability disclosure deadline to a 90+30 model that adds a 30‑day grace period after a vendor releases a patch. The original 90‑day countdown is described as a “brutal forcing function” that compelled vendors to develop and ship mitigations quickly, thereby raising industry standards for vulnerability handling and patch adoption. The new policy is presented as a double‑edged sword: it rewards vendors who deliver a patch within the initial 90 days by giving them extra time to encourage downstream adoption, but it also reduces the urgency to ship a fix and extends the window during which attackers can exploit the vulnerability, potentially increasing the number of exploitable systems. The speaker proposes a gradual reduction of the disclosure window—starting with 90+30, then moving to 90+25, 90+20, and eventually 85+20—while also noting Project Zero’s discussion of an 84+28 schedule designed to align with a 7‑day work week and avoid weekend deadlines. The overarching recommendation is to formalize a shrinking‑window calendar that continuously pressures vendors, aligns security practices with evolving adversary capabilities, and strengthens the digital ecosystem.
Chapters
Google's infamous Project Zero vulnerability research team recently announced it's changing its disclosure policy to be more friendly to product vendors. But is that really good for cybersecurity? Now, the Project Zero team is well respected in finding zero-day vulnerabilities in various digital products for the purpose of driving the industry to increase the speed speed and effectiveness of patch development, as well as improve patch adoption. Now, the default has been about 90 days, but the new policy will give an additional 30-day grace period if a patch has been released to enable patch adoption by end users. Well, the new 90+30 model is a double-edged sword. It provides a carrot to the vendors that respond with a good patch in the 90-day window, but it also lessens the pressure to drive actual integration of those patches on a customer's system. The way it normally works is Google Zero finds an unknown vulnerability and notifies the affected vendor. That vendor should acknowledge the vulnerability and begin working with great care to focus on developing a mitigation, usually in the form of a patch or an update. The public announcement clock begins, and the countdown for 90 days— well, when that's up, Google will publish technical details of the vulnerability that, well, it could assist hackers in creating viable exploits. This creates natural tension and is a brutal forcing function for vendors to work diligently to close the weaknesses in their products. Now, you might find that this particular tactic is kind of ruthless, but it was necessary early on. This is years back when product vendors often ignored vulnerabilities and they sometimes could take years to develop a fix. They were just mismanaging it, and they were trying to sweep it under the rug. And this forcing, this brutal tactic was instituted across the industry to change it, and it has. In fact, today we benefit from those brutal tactics, and now almost every, you know, digital vendor out there takes vulnerability reporting very seriously. So it's important, but it's also a little brutal. This is that, that function that forces companies, because they know the vulnerabilities are going to become public, and if they don't address them, it will be a detriment to their brand, their customers. So they want to stay on it. Now, the Project Zero policy constitutes what's considered currently in the industry as a standard, as an industry best practice for responsible reporting of product vulnerabilities. And their shift to this 90+30 environment is, well, I'm torn, to be perfectly honest. I think the 90/30 shift will actually reduce the pressure to deliver a good patch and motivate users to incorporate it, because right now it's really just in those 90 days. Giving them another 30, well, that gives them more leeway, and if people are given that leeway, they're gonna use it. The resulting 120 days increases the window of opportunity for hackers that have independently figured out the weaknesses and are building exploits. And simply put, there will likely be more exploitable systems available for attackers because of this. Conversely, I actually like rewarding the vendors who put forth the necessary effort to create proper mitigations and giving them the time to drive downstream adoption. So I do like that as well, and that is kind of a nice carrot. My overall recommendation though is to have a slowly shrinking window. Fine, let's start with the 90 plus 30. I'm okay with that. Let's move to that. But let's then drop that to a 90+25, maybe in 6 months, followed by a 90+20 in a year, then maybe even an 85+20, and so on, with progressively smaller windows over time. Now, Project Zero, on their blog, they actually talk about potentially moving to what they call an 84+28 model. And doing that maybe in 2022. But that's really just to make sure that the numbers are divisible by 7, right? A 7-day work week. And that way it avoids weekend deadlines, because unfortunately a lot of people were having to work those weekends to get under that deadline. So they wanted to kind of be nice to all those workers, um, in the security community trying to to get patches out, but they aren't willing to commit right now to a continuously improving schedule that shrinks the, the exposure window over time. And I think we need that because intelligent adversaries, they're getting better every year. Product development and sustaining security practices must also keep case. So let us formalize a plan to push the boundaries and drive ever better responses to these vulnerabilities. Such hard-coded expectations allow for organizations to plan ahead and, and plan accordingly. And it's exactly what that first 90-day disclosure countdown did so long ago. To make the digital ecosystem stronger. So let's repeat that tactic for everyone's benefit and define a calendar that definitively shrinks the exposure window over time, thus forcing progressive change for the better.
