Project Zero will disclose vulnerabilities 90 days after reporting (projectzero.google)
128 points by hacb 13 hours ago
wewewedxfgdf 5 minutes ago
Ubuntu will need a LOT more time than that.
my-huge-pony 6 hours ago
Starting today, our policy is “Full 90”, i.e. vulnerabilities will be disclosed 90 days after they are reported to the vendor.
On February 2, 2027, we will move to a “Full 60” policy where vulnerabilities are disclosed after 60 days.
On January 3, 2028, we will move to a “Full 30” policy where vulnerabilities are disclosed after 30 days.
ares623 4 hours ago
Perhaps eventually, they can finally live up to their namesake. On January 1 2029, we will move to a "Full 0" policy where vulnerabilities are disclosed after (looks at camera) zero days.
esafak 3 hours ago
If AI is doing all the work I could see that; same day remediation.
nextaccountic 2 hours ago
ares623 3 hours ago
level87 2 hours ago
Unrelated, but didn't realise .google was a TLD.
DaSHacka an hour ago
Actually many brands pay for their own TLD, though most go unused (publicly).
https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...
mindwok an hour ago
There's lots of them now. Companies can apply to have their own for a few hundred thousand dollars.
varun_ch an hour ago
so are .ads, .android, .cal, .chrome, .dclk, .docs, .drive, .gbiz, .gle, .gmail, .goog, .google, .guge, .hangout, .map, .meet, .play, .prod, .search,, .youtube, and .グーグル, .谷歌.
They are all owned by Google, but registrations are not open to the public.
Frost1x 2 hours ago
I’m not familiar with this specific effort but it seems like the companies digging around for the bugs should also offer similar access to their products that discovered the vulnerabilities to the vendors or OSS projects to patch them. Otherwise vendors might use this as a leveraged approach to get people to adopt LLMs, specifically theirs, so their products remain reasonably attractive. Google, OpenAI, Anthropic etc could just turn on existing software as a strategy to get more adoption of their tools.
“Don’t like our constant stream of patches? For $10k/mo + tokens you can get access to the model to patch the vulnerabilities we disclose!”
sumeno an hour ago
The "product" that finds Project Zero bugs is the people who work for Project Zero.
Refreeze5224 2 hours ago
Project Zero has been around far longer than GenAI or LLMs, so your point is not really relevant here.
Frost1x 2 hours ago
How is it irrelevant? Just because an effort existed before some change, doesn’t mean it can be repurposed and leveraged for other purposes. It’s the entire reason law and policy for government isn’t set in stone and is adaptable, because culture, technology and so on change.
The dynamic in this context absolutely has changed. Marginal cost to discover vulnerabilities from AI frontier labs and the big players has dropped significantly. The cost to patch is low, if you have access to certain resources. If you don’t, tough luck.
So this argument is essentially against the entire argument of AI alignment guardrails right now. Maybe you disagree with those, but I for one am happy they’re doing some things to protect against bio related warfare engineering. This is a case of cyber that’s about grey. Even there the labs have limited access to some and are choosing winners.
ylk 2 hours ago
Usually you can’t find the kind of bugs P0 finds by just throwing AI at it. You need highly skilled people driving/guiding it. Highly skilled people are the bottleneck.
In any case it’d be sensible to make yourself familiar with the “specific effort” before you make up your opinion on it.
clhodapp 2 hours ago
You say that like it's a bad thing...
I mean, sure, the cited $10k / mo is exploitative for small open-source projects but... in general, why wouldn't we want there to be pressure on companies and projects to use high-quality LLM-based checks if they want to see wide adoption?