From 031fb7280b6c2cc683b38f492b4100266ecb45f5 Mon Sep 17 00:00:00 2001 From: clearbluejar <3752074+clearbluejar@users.noreply.github.com> Date: Fri, 8 Dec 2023 17:48:37 +0000 Subject: [PATCH] another typo --- docs/Patch-Diffing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Patch-Diffing.md b/docs/Patch-Diffing.md index 43e6a3e..bf582b5 100644 --- a/docs/Patch-Diffing.md +++ b/docs/Patch-Diffing.md @@ -80,7 +80,7 @@ Patch diffing is a reality of the modern-day update process. For vendors of clos > Patch diffing is an often overlooked part of the perpetual vulnerability disclosure debate, **as vulnerabilities become public knowledge as soon as a software update is released, not when they are announced in release notes**. Skilled researchers can quickly determine the vulnerability that was fixed by comparing changes in the codebase between old and new versions. If the vulnerability is not publicly disclosed before or at the same time that the patch is released, then this could mean that the researchers who undertake the patch diffing effort could have more information than the defenders deploying the patches.[Maddie Stone -P0](https://googleprojectzero.blogspot.com/2020/04/tfw-you-get-really-excited-you-patch.html) -The controversy as to whether or not public disclosure of vulnerabilities is beneficial is up for [debate](https://www.scu.edu/ethics/focus-areas/business-ethics/resources/the-vulnerability-disclosure-debate/). One side of the argument proclaims public disclosure raises awareness of security issues, pressuring vendors to fix them. The counterargument is that disclosure provides a shortcut for attackers. . The [premise](https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html) of groups like Project Zero releasing vulnerabilities for the “greater good” is hotly contested. Whether or not you agree, a security patch is a form of vulnerability disclosure that is **always public**. +The controversy as to whether or not public disclosure of vulnerabilities is beneficial is up for [debate](https://www.scu.edu/ethics/focus-areas/business-ethics/resources/the-vulnerability-disclosure-debate/). One side of the argument proclaims public disclosure raises awareness of security issues, pressuring vendors to fix them. The counterargument is that disclosure provides a shortcut for attackers. The [premise](https://googleprojectzero.blogspot.com/2020/01/policy-and-disclosure-2020-edition.html) of groups like Project Zero releasing vulnerabilities for the “greater good” is hotly contested. Whether or not you agree, a security patch is a form of vulnerability disclosure that is **always public**. ## Benefits