When will the analysis phase be completed? Consider Checkpoint are a Security vendor its pretty poor show that this is taking so long to either fix or confirm there product is not vulnerable.
More interesting question, if a vendor device is compromised, after the vendor has acknowledge said issue but not yet resolved it, could they be liable for any loss of earnings or reputation damage...interest scenario to think of.
Is there a legal grace period in which the vendor would have to analysis, and release a statement, which would cover them and customers?
