Timing of releases
Submitted by John Dowdell on May 7, 2008 - 14:59.

Hi Gregg, I’d defer to members of Adobe’s security team for full details, but usually we don’t provide additional info about the nature of an exploit until all versions are updated.

The Acrobat 8.x series was updated awhile ago, but today the Acrobat 7.x series was also updated, for those intranets which have slow approval cycles for new major versions.

(This practice also gives a significant number of consumers a chance to get protected, before providing background info to security researchers which might incidentally help criminals.)

jd/adobe

Adobe Reader 8.x was released pretty quickly. But details of what it fixed were not published until after we had older versions updated too. (Sometimes an intranet will approve minor versions on a shorter cycle than they will major versions, and so we need to go back and update older codebases as well.)

So the answer to Gregg’s implicit question of “Why did it take so long to learn juicy details of badguy practices?” would be something like “To give current users a meaningful chance to update first, and also to take care of people who cannot use the current version.”

Good?

jd/adobe