undefined | Better HN

0 pointsjudge20205y ago0 comments

A 0-day generally means either one person, a single organization, or a small group of people, know about the exploit in question. As soon as an exploit is widely known or published, it's not a 0-day since anyone can find it, even if the exploit is for abandoned software that'll never receive a security fix.

0 comments

3 comments · 1 top-level

ltbarcly35y ago· 2 in thread

Yep, that's what I said I think (by 'known' I meant publicly). Once it's widely known, it's a 0 day for 24 hours, then it's not anymore. That's what we used to mean by 0-day anyway. Other people will tell you that it's a 0-day until there is a patch against it. I think different people use this this phrase so divergently that using it isn't a useful way to communicate anymore.

neltnerb5y ago

What is it called after there is a patch against it? Does it just stay at like a 27-day if it takes 27 days to patch?

I feel like in common parlance calling something a 0-day would imply that it is something the manufacturer didn't expect and has no solution for which is a big problem. I guess whatever communicates information best. I kind of feel like we just use 0-day to mean big problems, everything else is just a bug that has some age, and then fixed stuff doesn't get remembered. Right?

That seems fairly useful, at least in communicating to the general tech media.

aj35y ago

If you know about the bug, but manufacturer does not provide any patches, you can still mitigate it, put in place detection measures or just stop using that software. You can't (necessarily) do those if you don't even know about the bug yet as it hasn't been published. That's why 0day is a useful term.

j / k navigate · click thread line to collapse