Google relaxes Project Zero bug disclosure policy after Microsoft complaints
Google managed to ruffle a few feathers recently by disclosing bugs and security problems in widely used software. Project Zero is used to encourage companies to fix issues that have been detected by imposing a 90-day deadline before details of the vulnerabilities are made public.
Microsoft was angered a month ago when Google published details of a security issue in Windows 8.1 just a few days before a patch was due to be released. A few days later, two more bugs were revealed leading to complaints not just from Microsoft but from software users. Now Google has backed down and announced a slight relaxing of its previously strict 90-day disclosure policy.
This is not to say that the 90-day policy is going away, just that there will be a little more flexibility in the future. For example, if the deadline runs out on a weekend or public holiday, it will be rolled over to the next working day. This is something that will go down well with software developers, but the introduction of a 14-day grace period is something that will particularly please Microsoft.
