3 ms·

Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.

deleted 9y ago
[deleted]
hobonumber1 9y ago
He just wants attention.
SAI_Peregrinus 9y ago
Letting the development team know first is nice to the development team, but not so nice to the users (especially not-nice if there's a workaround, which there is in this case.) My personal policy: If there's a workaround or mitigation, then full disclosure is more responsible. If there isn't then report to developers and CERT or similar. Never report only to developers, always have a deadline for full disclosure, and always have a third-party (CERT, Project Zero, etc) to disclose if you come under legal fire.
5ilv3r 9y ago
Time and time again we have been shown that the way to a company's heart is through it's PR department. This is a dev complaining to Apple like a lunchgoer would complain to Mc D's about a bad burger. Expect more of it.
- kiliankoe 9y ago
  Seems to go for almost all issues regarding Apple. I've been reporting that calculator bug since iOS 9, with updates for several betas that it's still there. Two years later someone with a significant following on Twitter writes about it, gets enough retweets and Apple finally fixes something so miniscule.
fastball 9y ago
Nah, Apple really needs to realize that they need to step up their game. This might hurt some users, but it sets a much needed fire under Apple's ass.
Quarrelsome 9y ago
its such a braindead problem that its plausible that the person who disclosed it over twitter didn't know what responsible disclosure is. Usually exploits are hard to exploit meaning that those who find them likely know of responsible disclosure. In this case though anyone who has ever installed Linux is capable of stumbling upon this.
vortico 9y ago
If the vulnerability required scripting or special tools to be written, yes, it should be disclosed in private. But anyone can happen upon this, and I imagine the reaction for most is "Huh! That's funny! My friends and followers would get a kick out of this!" He was just being social about a problem he found with his new computer, which is something most people would do upon finding a something you can laugh about.

deleted 9y ago

[deleted]

hobonumber1 9y ago

He just wants attention.

SAI_Peregrinus 9y ago

Letting the development team know first is nice to the development team, but not so nice to the users (especially not-nice if there's a workaround, which there is in this case.) My personal policy: If there's a workaround or mitigation, then full disclosure is more responsible. If there isn't then report to developers and CERT or similar. Never report only to developers, always have a deadline for full disclosure, and always have a third-party (CERT, Project Zero, etc) to disclose if you come under legal fire.

5ilv3r 9y ago

Time and time again we have been shown that the way to a company's heart is through it's PR department. This is a dev complaining to Apple like a lunchgoer would complain to Mc D's about a bad burger. Expect more of it.

kiliankoe 9y ago
Seems to go for almost all issues regarding Apple. I've been reporting that calculator bug since iOS 9, with updates for several betas that it's still there. Two years later someone with a significant following on Twitter writes about it, gets enough retweets and Apple finally fixes something so miniscule.

fastball 9y ago

Nah, Apple really needs to realize that they need to step up their game. This might hurt some users, but it sets a much needed fire under Apple's ass.

Quarrelsome 9y ago

its such a braindead problem that its plausible that the person who disclosed it over twitter didn't know what responsible disclosure is. Usually exploits are hard to exploit meaning that those who find them likely know of responsible disclosure. In this case though anyone who has ever installed Linux is capable of stumbling upon this.

vortico 9y ago

If the vulnerability required scripting or special tools to be written, yes, it should be disclosed in private. But anyone can happen upon this, and I imagine the reaction for most is "Huh! That's funny! My friends and followers would get a kick out of this!" He was just being social about a problem he found with his new computer, which is something most people would do upon finding a something you can laugh about.