> So I guess Microsoft missed both of those deadlines.
No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was no additional 14-day period (for whatever reason).
The grace period isn't automatic, otherwise that would just be a 104 day window. The grace period applies when the vendor has been in communication with P0 that a patch is in the works and will be released within 2 weeks of the end of the 90 day window. Presumably that didn't happen here.
I wasn't proposing that it was automatic. "For whatever reason" means just that. I wasn't making any statement about why there was no additional 14-day window.
There is always an additional 14-day period on offer, but the vendor has to choose to use it, and has to actually land the patch within the 14 extra days.
So, a deadline miss is often really a 104 (!!) day deadline miss. As an industry that's trying to refocus on security, surely we can do better than that.
No. It was 90 days from the time the bug was filed to the time it automatically disclosed. There was no additional 14-day period (for whatever reason).