5 ms·

While this exploit sounds like trouble, what's more disconcerting to me is that in mid-2010 Apple still doesn't have a functioning system in place to handle res

While this exploit sounds like trouble, what's more disconcerting to me is that in mid-2010 Apple still doesn't have a functioning system in place to handle responsible disclosure.

jonknee 16y ago
Email product-security@apple.com or go the extra mile and encrypt it: https://www.apple.com/support/security/pgp/ https://www.apple.com/support/security/pgp/
- mishmash 16y ago
  Apparently, he did: > I figured Apple might appreciate a vulnerability disclosure prior to public discussion, which I did on June 17, 2010 complete with technical detail. A gleeful auto-response came shortly after, to which I replied asking if Apple was already aware of the issue. I received no response after that, human or robot.
  - KirinDave 16y ago
    Yeah. And he waited just over a month. Which is not very long, compared to other similar vendors. I suspect that Apple doesn't have a lot of goodwill in the security community these days. For better or worse, they're viewed as indifferent on the subject of security.
tptacek 16y ago
That's not fair; hundreds of people report vulnerabilities to Apple every year. We've done it, many times. They're not lightning fast, but they aren't blowing people off either.
- mishmash 16y ago
  You might be right. I should have written "a fail proof" system instead. And really, I don't think it's that unreasonable to expect a fail proof level of response on security vulnerabilities from the world's most valuable computer company.
  - tptacek 16y ago
    Let me tell you from long and painful personal experience that nobody in the industry has a "fail proof level of response", including Microsoft, which has outspent the rest of the industry combined by a significant multiple. Your expectations are unrealistic. The biggest problem this whole industry has right now is that it is excruciatingly hard to find talent. Nobody has enough people. Everyone, from Google through MSFT through Adobe though Apple through Cisco &c &c &c, is screwing things up because of it.
    - mishmash 16y ago
      > Your expectations are unrealistic. Wait, what? You think it's unrealistic to expect every security-related bug filed to get some kind of a human follow up within 30+ days?? And this from a company that made over one BILLION in profit during that same time frame? Uh, no.
      - wglb 16y ago
        The lead-up to your quoted phrase is it is excruciatingly hard to find talent describes why this is the case.
        mishmash 16y ago
        Are you suggesting there's some kind of shortage of people who can check an email/database and reply: "Hello this x, with Apple's Product Security team. We've received your report and have assigned it #123456. We will begin investigating soon. Thanks"
        tptacek 16y ago
        I think you should find a security bug in any Apple product and report it before you make representations as to how they handle stuff like this. It's not that hard.
        16y ago

While this exploit sounds like trouble, what's more disconcerting to me is that in mid-2010 Apple still doesn't have a functioning system in place to handle responsible disclosure.

jonknee 16y ago

Email product-security@apple.com or go the extra mile and encrypt it: https://www.apple.com/support/security/pgp/ https://www.apple.com/support/security/pgp/

mishmash 16y ago
Apparently, he did: > I figured Apple might appreciate a vulnerability disclosure prior to public discussion, which I did on June 17, 2010 complete with technical detail. A gleeful auto-response came shortly after, to which I replied asking if Apple was already aware of the issue. I received no response after that, human or robot.
- KirinDave 16y ago
  Yeah. And he waited just over a month. Which is not very long, compared to other similar vendors. I suspect that Apple doesn't have a lot of goodwill in the security community these days. For better or worse, they're viewed as indifferent on the subject of security.

tptacek 16y ago

That's not fair; hundreds of people report vulnerabilities to Apple every year. We've done it, many times. They're not lightning fast, but they aren't blowing people off either.

mishmash 16y ago
You might be right. I should have written "a fail proof" system instead. And really, I don't think it's that unreasonable to expect a fail proof level of response on security vulnerabilities from the world's most valuable computer company.
- tptacek 16y ago
  Let me tell you from long and painful personal experience that nobody in the industry has a "fail proof level of response", including Microsoft, which has outspent the rest of the industry combined by a significant multiple. Your expectations are unrealistic. The biggest problem this whole industry has right now is that it is excruciatingly hard to find talent. Nobody has enough people. Everyone, from Google through MSFT through Adobe though Apple through Cisco &c &c &c, is screwing things up because of it.
  - mishmash 16y ago
    > Your expectations are unrealistic. Wait, what? You think it's unrealistic to expect every security-related bug filed to get some kind of a human follow up within 30+ days?? And this from a company that made over one BILLION in profit during that same time frame? Uh, no.
    - wglb 16y ago
      The lead-up to your quoted phrase is it is excruciatingly hard to find talent describes why this is the case.
      - mishmash 16y ago
        Are you suggesting there's some kind of shortage of people who can check an email/database and reply: "Hello this x, with Apple's Product Security team. We've received your report and have assigned it #123456. We will begin investigating soon. Thanks"
        tptacek 16y ago
        I think you should find a security bug in any Apple product and report it before you make representations as to how they handle stuff like this. It's not that hard.
        16y ago