I got this from yesterday's ISC handler's diary. Is it better to release a patch as soon as possible after a vulnerability, mark it as unstable until it can be properly tested, then move it to stable when it is, or to release them all once a month?
There are problems with both models, not the least of which is how much information you are releasing to attackers as most exploits we are seeing are reverse engineered from the patch. However, is it better to deal with one or two exploits over a month or deal with them all for a day or two (or three), and does not releasing the patch for a month actually prevent people from coding exploits?
If you have been reading this blog for much time at all you would know my answers to these questions. I would like to hear yours however.


I just pointed this out in my last entry, but I felt it deserved its own entry. I once discussed the trade-off inherent in introducing a patch schedule, and I have said it before (one, two, three). The latest patches from Microsoft fix some vulnerabilit
Tracked: Dec 15, 17:52