Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It was a zero day up until the first report was made.


That's always true though. 0-day implies it was discovered being actively exploited or that it was released on the 0th day it was discovered.


I believe “0 day” actually refers to the number of days that the vendor has had to fix the issue, not how many days it’s been since it’s discovered. For example, there might be a substantial delay between bug discovery and actual disclosure to the vendor–I usually take a couple days to write up a nice explanation and PoC. If I had found something and then published it publicly the next day without disclosing it, it’d still be a zero day.


You're right I should have said 0 days since it was disclosed to the vendor. That would be more accurate.

Regardless, this bug is definitely not 0 day given that it was disclosed to the vendor last month.


It doesn't matter what you "believe"

That's not what that word means. Zero-day refers to actively exploited bugs. Stop hijacking words just to overhype your research.


I didn't write the article, so I'm not sure what you mean by overhyping my research. But what you mentioned is referred to as "zero day exploited in the wild"; a zero day doesn't have to actually be actively exploited.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: