6 ms·
The poster practiced Full Disclosure, which is also a valid disclosure policy. Since we're just making up statements, I guarantee that Apple would never volunt
by dsp1234 9y ago
The poster practiced Full Disclosure, which is also a valid disclosure policy.
Since we're just making up statements, I guarantee that Apple would never voluntarily disclose this issue if it was reported privately. So Full Disclosure is the only way to put Apple's feet to the fire, as it's the only way in which this issue would have had any visibility whatsoever.
https://en.wikipedia.org/wiki/Full_disclosure_(computer_security) https://en.wikipedia.org/wiki/Full_disclosure_(computer_secu...
- Bud 9y agoOn what basis do you "guarantee" this?
- eyelidlessness 9y agoIt's used as an idiom, meaning roughly "I have total confidence".
- JadeNB 9y ago> On what basis do you "guarantee" this? I think on the (probably intentionally snarky) basis of "just making up statements": > Since we're just making up statements, I guarantee that Apple would never voluntarily disclose this issue if it was reported privately.
- SahAssar 9y agoPrivate Disclosure does not prevent you from publicly disclosing it after a grace period.
- falcolas 9y agoWhat grace period is appropriate for a 0 day root login vulnerability? This guy is, with all probability, not the first one to have found it.
- simplify 9y agoIf there was a vulnerability that allowed anyone to open your car and drive off with it, you wouldn't care if he was the first to find it or not. You'd only care about it getting fixed before anyone else knows about it. I'm not sure what length grace period is appropriate, though.
- cwkoss 9y agoIf there was a vulnerability that allowed anyone to open my car, I'd want to known ASAP, because I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk. Same applies for Apple. No reason to believe this guy was the first one to find this exploit, we only know he was the first one to publicize it.
- simplify 9y ago> I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk. True, and this is where the analogy breaks down, since they would not be able to remotely send over a fix. But Apple would, and apparently now has.
- greedo 9y agoTo be pedantic, this isn't a 0day root login vuln, but a priv escalation vuln.