Because if OpenBSD pushes out broken patch, nobody will care, as this is business in usual in free software world, shit breaks, WITHOUT ANY WARRANTY and all that. On the other hand, if Microsoft does that, customers paying millions of dollars will get pissed.
That said, 100+ days to push out a patch is indeed ridiculous.
Except OpenBSD isn't shipping broken patches.. so I'm struggling to see your point.
There's a pretty substantial difference between 3 days and 90 days (or 100). And one could argue that any amount of days after the embargo ends, is plenty opportunity for their paying customers to remain vulnerable without having provided any fixes, regardless of whether it is broken or not.
I seriously doubt that OpenBSD can ensure that their patches don’t break their users in 3 days. Additionally, if their patches do break their users, OpenBSD can, unlike Microsoft, claim that it’s working as intended, and if you don’t like it, tough shit. Microsoft doesn’t really have this as an option.
You are extremely generous in assuming Big Corp is using whole 90 days for fix and validation. In might have being sitting in a backlog for 90% of that time.
Indeed, that OpenBSD can succeed in 3 days, with an errata team typically between 4-6 people, what Microsoft as a company with well over a hundred thousand employees, is failing at 90 days. Doesn't explain that.
That... Sounds like their problem. Like, I get that they have way more api surface, legacy code to support, etc... But they have a budget and manpower to match. If they can't test changes, that's their fault.
Microsoft fired their testers in 2018 [1]. Since then we've seen a surge of pretty serious bugs, some of which had to be pulled [2]. Not saying this is related, as this is a vulnerability and not a bug in an update, but 100 days to release a patch is telling.
>"The number of apps in its Windows Store had dwindled to 13 percent of the 1.1 million offered in 2014, the company said, and it needed less bug testing from Lionbridge, according to a January 2017 memo obtained via a FOIA request."
From memory they used to restrict all warranty claims to USD$5, but it appears it's been increased to USD$50 (or the sales price). I would wager it's probably because offering a maximum relief of less than 5% the cost of the product was found to be illegal somewhere.
That said, 100+ days to push out a patch is indeed ridiculous.