kolliden · Nov 5, 2026

Shorten the deadline

2 reasons2 sources

What this position proposes

Disclosure deadlines get shorter, so users learn about flaws sooner, even if some are published before a fix exists.

Reasons

1.
Attackers have the same AI tools, so a bug one company finds is likely to be found by someone else long before 90 days pass.^[1]^[2]
1. Source 1: Atlantic Council: New AI models are pushing open-source security to its limits. Their developers must step up. · atlanticcouncil.orgOpen original
2. Source 2: The Hacker News: Red Hat patches 9.8-rated Linux TCP RCE flaw while Ubuntu releases fixes for testing · thehackernews.comOpen original
Objections
- Keep 90 days · Overstated
  No attacks on CVE-2026-98432 had been reported even after its exploit was announced, so real attackers are still slower than the theory.^[1]
  1. Source 1: The Hacker News: Red Hat patches 9.8-rated Linux TCP RCE flaw while Ubuntu releases fixes for testing · thehackernews.comOpen original
- Give maintainers more time · Doesn’t follow · Unsourced
  A shorter deadline doesn’t create more maintainers; it only publishes more bugs that nobody has had time to fix.
2.
Once a flaw is public, users can protect themselves with workarounds instead of waiting blind for a patch.^[1]
1. Source 1: The Hacker News: Red Hat patches 9.8-rated Linux TCP RCE flaw while Ubuntu releases fixes for testing · thehackernews.comOpen original
Objections
- Keep the deadline, make the finders fix it · Leaves something out · Unsourced
  Red Hat could ship a workaround because it has paid engineers; most open-source projects can’t publish one within days.
- Keep 90 days · Leaves something out · Unsourced
  Publishing a bug before it is fixed also tells attackers exactly where to look.

Anyone can add a reason, an objection or a source here. You create a free account when you publish. Already have one? Sign in.