前幾天發佈了 Windows 與 Samba 共同有的安全性問題，叫做 Badlock：「Hype Around the Mysterious ‘Badlock’ Bug Raises Criticism (WIRED)」。但這個 bug 在 4/12 前不會公佈：
On April 12th, 2016, a crucial security bug in Windows and Samba will be disclosed. We call it: Badlock.
長達三個禮拜的時間可以讓其他人找出問題是很罕見的，主要是因為這已經提供足夠多資訊去挖掘。名稱叫做 Badlock，看起來是某種 lock + race condition 造成的，而 Windows 與 Samba 同時都有問題，應該是 Microsoft 與 Samba 合作後的程式碼，或是某種 protocol workflow 的問題造成的。
It's especially interesting in this case since we have a name "Badlock" so we know it probably involves locking. We know it affects Samba and Windows. And we know who it was found by so we can look at which bits of Samba they've been working on lately. That's a lot of information for a clever person.
我預期這三個禮拜內應該就會有人公佈，目前的資訊真的太多了。更糟糕的有可能不是發 0-day exploit，而是這個漏洞進入黑市被利用。
先發表有漏洞，再給三個禮拜讓 vendor patch 的行為，看起來就是研究團隊為了出名造勢，而搞砸真正的資安問題。