Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is it 0day or is it not. "0day" is not an important word except that the media has started using it. For those of us working in the field, it's just a fun term, not a legal term. It is used to distinguish the risk of a bug, not the ethical handling of it. It has always been in relation to risk. The risk is greatest when it is a. unknown to anyone but a few b. unknown by a wide enough audience to effect its application c. unfixable or as yet unpatched. Some in the field call bugs fitting any one of these qualification 0days, other's not. But nearly no one in the field uses this term to quantify the ethical handling of a bug (as in: age starting from moment vendor knows about bug).

Consider what a 1day is. A "1day" bug is one that looses value because it is likely that some systems have now been patched such that you as an attacker are not guaranteed that every system you touch with your exploit will fall. A 365day is likely useless, depending on the target platform. Hence, the entirety of its meaning has to do with risk, not procedure or ethics.

It is fine if you read Wikipedia's definition and decide the meaning is otherwise. After all, language changes. But if anyone in the future wants to understand the etymology of the meaning behind "0day" they should consider that the meaning appears to have changed (in the minds of many that actually don't even work in the field of reverse engineering).



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: