6 ms·

Closed disclosure does, to a large degree, prevent negative publicity. I don't think it is in dispute that this bug would receive vastly less media coverage if

Closed disclosure does, to a large degree, prevent negative publicity. I don't think it is in dispute that this bug would receive vastly less media coverage if it were only revealed as a bug in outdated/patched versions of the OS. I don't want to see Apple hurt (I'm an Apple-guy myself, using Macs, iPhone, iPad and Apple Watch), I want to see them improve. I doubt they start will start caring about QA unless they're forced to. One absurdly serious and stupid password bug like this can be a honest mistake, but three (that we know of, that were full disclosures) in a few months is negligence that should be criminal if it isn't.

ukblewis 9y ago
I actually do think it is in dispute. This is a tweet after all. This guy could totally tweet about it in much the same way after Apple released a patch. The negative publicity would still exist because the bug would be equally stupid and disastrous, just fewer people would be harmed along the way.
- mark-r 9y ago
  It wouldn't be as clear that the bug is widely reproducible after the patch is put out. And it certainly wouldn't gather as much attention.
  - freedomben 9y ago
    Exactly. Everyone I know on Mac immediately tried reproducing this bug the moment they heard about it. On those systems where it didn't reproduce, they immediately dismissed it as a false report.
  - ksec 9y ago
    That is assuming people patch their Mac ASAP. It will still be on high alert for most media if they have disclose it few days after the bug was fixed.
- deleted 9y ago
  [deleted]
thetruthseeker1 9y ago
Closed disclosure is responsible disclosure. Moving past the terminology, I am an Apple user as well, I am pretty satisfied with how quickly Apple resolves issues. Now if every person started disclosing vulnerabilities via twitter without giving the company turn around time to resolve the issue based on their dissatisfaction with Apple based on standards they came up with personally, I don’t think it is nice or fair.
- crankylinuxuser 9y ago
  So, obscurity is responsible disclosure? Cause being "closed disclosure" is being obscure. A root password solves this issue. Its seconds to implement and helps right now.... Not "later" as closed disclosure does. I'd rather know every error and critical bug. I can bring up with our team and decide now to either sudo service * stop or continue. Your closed options keep the fact I'm vulnerable away, along with any pathways I might have to fix.
  - BinaryIdiot 9y ago
    This is a rather limited view point. You forget the majority of macOS users are NOT technically savy. This is why responsible disclosure is so important as it gives tech companies time to create and push a fix to protect their users. Disclosing this immediately puts those people who can't setup enable the root and set its password into more harm's way.
    - crankylinuxuser 9y ago
      > You forget the majority of users are NOT technically savy. Fixed that for you. Sorry, I'm not going to cater to the lowest common denominator of "users". If my system has a hole, I want to know so I can get in a fix or shut down that particular feature until its fixed by a vendor. Ive only 60k machines and 40 clients that depend on that decision. And they agree with me. If something's broke, I can analyse how it breaks and if it impacts us. If it does, we can triage it. I can do a damage assessment. I certainly can't do that if it's being sold on the darknets and whispered.
azernik 9y ago
Giving Apple negative publicity is not an end that justifies harming its users.

ukblewis 9y ago

I actually do think it is in dispute. This is a tweet after all. This guy could totally tweet about it in much the same way after Apple released a patch. The negative publicity would still exist because the bug would be equally stupid and disastrous, just fewer people would be harmed along the way.

mark-r 9y ago
It wouldn't be as clear that the bug is widely reproducible after the patch is put out. And it certainly wouldn't gather as much attention.
- freedomben 9y ago
  Exactly. Everyone I know on Mac immediately tried reproducing this bug the moment they heard about it. On those systems where it didn't reproduce, they immediately dismissed it as a false report.
- ksec 9y ago
  That is assuming people patch their Mac ASAP. It will still be on high alert for most media if they have disclose it few days after the bug was fixed.
deleted 9y ago
[deleted]

thetruthseeker1 9y ago

Closed disclosure is responsible disclosure. Moving past the terminology, I am an Apple user as well, I am pretty satisfied with how quickly Apple resolves issues. Now if every person started disclosing vulnerabilities via twitter without giving the company turn around time to resolve the issue based on their dissatisfaction with Apple based on standards they came up with personally, I don’t think it is nice or fair.

crankylinuxuser 9y ago
So, obscurity is responsible disclosure? Cause being "closed disclosure" is being obscure. A root password solves this issue. Its seconds to implement and helps right now.... Not "later" as closed disclosure does. I'd rather know every error and critical bug. I can bring up with our team and decide now to either sudo service * stop or continue. Your closed options keep the fact I'm vulnerable away, along with any pathways I might have to fix.
- BinaryIdiot 9y ago
  This is a rather limited view point. You forget the majority of macOS users are NOT technically savy. This is why responsible disclosure is so important as it gives tech companies time to create and push a fix to protect their users. Disclosing this immediately puts those people who can't setup enable the root and set its password into more harm's way.
  - crankylinuxuser 9y ago
    > You forget the majority of users are NOT technically savy. Fixed that for you. Sorry, I'm not going to cater to the lowest common denominator of "users". If my system has a hole, I want to know so I can get in a fix or shut down that particular feature until its fixed by a vendor. Ive only 60k machines and 40 clients that depend on that decision. And they agree with me. If something's broke, I can analyse how it breaks and if it impacts us. If it does, we can triage it. I can do a damage assessment. I certainly can't do that if it's being sold on the darknets and whispered.

azernik 9y ago

Giving Apple negative publicity is not an end that justifies harming its users.