Earlier quoted context omitted.
The 90 day window is an industry standard for zero-days, how the author worded it is neither here nor there. 90 days is ample time for even a half-functioning organization to address the issue in some way. I agree with Red Threat’s decision to not show their hand in the first email. The altruistic take on this is that they do not want the email to fall upon deaf ears (or even a bad actor within a company) and would p…
90 days isn't really an industry standard. It's what Google unilaterally decided upon when they chose to staff up Project Zero and reflects their assumptions being, as they are, a company that grew up on the web. One of those assumptions is that you have fully automated test processes and the ability to remotely update any/all installs of your software within a week or so, which in turn implies that users aren't invo…
Assume you're a bank robber... place a bug (e.g. a raspi with an lte dongle) in a cabinet somewhere, now you control all traffic lights in the city. Then when you do the heist, progressively turn each intersection you pass all-sides green, and dumbass drivers will do the rest and prevent the police from catching up with you.
At least here in Germany, IIRC there used to be a mandate for a "detect conflicting greens" hardware interlock - pretty simple, wire the green light powers to AND gates, and if they trigger, shut down the cabinet hard. Same for a red light burning out - measure the current on each red light power line, if it drops below a threshold, shut down everything else to avoid a driver not seeing any light and t-boning someone who legitimately has green.
But a system without such a hardware interlock will just happily do what is asked of it.