Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 9 down vote favorite

I came across this term recently in a mail chain. Google tells me there is a term zero-day bug and that Microsoft and Adobe are the frontrunners :)

Is there such a term as day one bug? What might that mean?

share|improve this question
2  
Does it really matter given that noone seems to be using it? – Mchl Jul 4 '11 at 20:36
4  
-1 I don't get it. If this term is used then there obviously is such a term. If it's made up then it's made up. What might it mean? I donno. 42? – Guy Sirton Jul 4 '11 at 21:05
1  
It means that your "Dead Relative" in Ghana with the fortune they imbezeled through their computer trickery... does not really exist... I know that probably shakes you to the core. – Chad Jul 5 '11 at 18:24

5 Answers

up vote 21 down vote

A day-one bug is a defect that is not a regression. The defect was there from day one when the feature was implemented. It is used to argue that a defect is low priority, because it has been shipped in previous releases without many complaints from customers.

Citations:

share|improve this answer
3  
[citation-needed] – Piskvor Aug 30 '11 at 19:03
@Piskvor citations provided, see updated version answer – gnat Mar 30 '12 at 15:21
@gnat: Thanks a lot! – Piskvor Mar 30 '12 at 16:26
up vote 3 down vote

Wikipedia states

A "zero day" attack occurs on or before the first or "zeroth" day of developer awareness

By this definition, would a day one bug would one where an exploit is developed the second day of developer awareness?

However, from Infoworld.com

Zero-day bugs are vulnerabilities that have not been patched or made public.

They further quote Justine Aitel, CEO of Immunity as stating

"Bugs die when they go public, and they die when they get patched,"

I suppose you could infer from this definition that a "one day bug" would be a meaningless term, or I guess you could say it's one for which a patch exists in the public, but which the user has not applied the patch to.

share|improve this answer
2  
Can we have a more authoritative source than wikipedia! – Loki Astari Jul 4 '11 at 19:29
2  
@Martin Sure we can. – Stephen Jul 4 '11 at 20:32
@Martin just because its wikipedia doesn't automatically make it non-authoritative – Kenneth Jul 4 '11 at 22:11
@Kenneth: Actually that is exactly what wikipedia is (non-authoritative). It is a perfect place to start research to find an authoritative source but in-itself it is not authoritative (as wikipedia itself defines itself as). Check out the finders original statement about the site. – Loki Astari Jul 5 '11 at 1:14
5  
@Martin: Wikipdia is not authoritative, but the sources it cites are. So we don't need to be picky about Wikipedia being authoritative or not, we can just scroll down and look at the works cited section and see for ourselves. – Richard DesLonde Jul 5 '11 at 7:55
show 1 more comment
up vote 1 down vote

Ask the person who used the expression. It is not widely-enough used for a generally-agreed-upon definition to exist.

A "zero day exploit" is a security exploit that the developer of the software (or the security community in general) has known about for 0 days (i.e. not yet) so that there can't be a fix. Extrapolating from that, a "one day exploit" would be one that has become publically known today, so if the developer and the users act fast, a few systems may already be patched.

But that extrapolation is not necessarily correct, the expression may not have anything to do with zero-day exploits. Brian's answer actually sounds more likely. Which leads us back to my first paragraph.

share|improve this answer
up vote 0 down vote

heard it used jokingly for bugs that would take a day of developer time to fix, but that's not at all a "formal definition", it was just a figure of speech used in one specific company.

share|improve this answer
up vote -1 down vote

A "day one" bug is simply a bug that has been around a long time (day one being the software's creation date), as compared to a "regression", or recently introduced bug. When analyzing a problem which has just been reported for the first time, it is general practice to focus on recent changes to the software as the most likely source of the problem. Some bugs however, lead a charmed life and lay dormant for years (or even decades) without being noticed. In my experience as a developer, day one bugs generally are masked by other software that repairs the damage or prevents the bug from being exercised; seemingly unrelated changes can remove one of these "compensating factors" which allow the original bug to finally manifest and be noticed. I found a bug in 2012 in code that I wrote in 1986 and which had processed billions if not trillions of transactions at hundreds of installations before its first crash. I spent several days convincing myself (by constructing elaborate tests) that the bug was truly day one.

The term "zero day" is totally unrelated to the much older "day one".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.