HP TippingPoint’s Zero Day Initiative will give vendors six months to come up with a fix. Previously, ZDI’s policy was to withhold a vulnerability, publishing its information only after a patch had been issued. If a fix isn’t ready by the deadline, the program will issue an advisory with “limited details” of the vulnerability. Microsoft says it disagrees with the new deadline, but says it wishes they had set a tougher deadline for the bug bounty program. ZDI is holding information on 31 bugs that it reported to vendors a year ago or longer.”]
Source: https://www.csoonline.com/article/2125807/patch-or-we-go-public–says-bug-bounty-program.html