Skip to content

Commit

Permalink
another typo
Browse files Browse the repository at this point in the history
  • Loading branch information
clearbluejar committed Dec 8, 2023
1 parent b23b9af commit 031fb72
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion docs/Patch-Diffing.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ Patch diffing is a reality of the modern-day update process. For vendors of clos

> Patch diffing is an often overlooked part of the perpetual vulnerability disclosure debate, **as vulnerabilities become public knowledge as soon as a software update is released, not when they are announced in release notes**. Skilled researchers can quickly determine the vulnerability that was fixed by comparing changes in the codebase between old and new versions. If the vulnerability is not publicly disclosed before or at the same time that the patch is released, then this could mean that the researchers who undertake the patch diffing effort could have more information than the defenders deploying the patches.[Maddie Stone -P0](https://googleprojectzero.blogspot.com/2020/04/tfw-you-get-really-excited-you-patch.html)
The controversy as to whether or not public disclosure of vulnerabilities is beneficial is up for [debate](https://www.scu.edu/ethics/focus-areas/business-ethics/resources/the-vulnerability-disclosure-debate/). One side of the argument proclaims public disclosure raises awareness of security issues, pressuring vendors to fix them. The counterargument is that disclosure provides a shortcut for attackers. . The [premise](https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html) of groups like Project Zero releasing vulnerabilities for the “greater good” is hotly contested. Whether or not you agree, a security patch is a form of vulnerability disclosure that is **always public**.
The controversy as to whether or not public disclosure of vulnerabilities is beneficial is up for [debate](https://www.scu.edu/ethics/focus-areas/business-ethics/resources/the-vulnerability-disclosure-debate/). One side of the argument proclaims public disclosure raises awareness of security issues, pressuring vendors to fix them. The counterargument is that disclosure provides a shortcut for attackers. The [premise](https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html) of groups like Project Zero releasing vulnerabilities for the “greater good” is hotly contested. Whether or not you agree, a security patch is a form of vulnerability disclosure that is **always public**.

## Benefits

Expand Down

0 comments on commit 031fb72

Please sign in to comment.