With a computer vulnerability, disclosing information oftentimes means that intruders will use that information to compromise systems. However, the public at large has a real interest in knowing if there are defects. CERT hopes the 45-day waiting period, which can be extended in certain circumstances, will give developers enough time to address the problems, while balancing the public's need to be informed. If the software provider makes good-faith attempts to respond to security defects, then the security by obscurity models work. But a lot of these defects have been around for a while and no one ever disclosed them.
Software providers are worried more about their public image than fixing the defects.
CERT's decision isn't all about publicity. Creating that consensus may not be easy. For example, not everyone agrees how much information should be revealed about a bug. Chistopher Klaus, chief technology officer for Internet Security Systems , a leading security company that provides software and professional services, says he gets reports of as many as 100 new software vulnerabilities per month. When it comes time to publicize a problem, Klaus says it is important not to give out too much information.