4 ms·

Real problem is that if you are nobody then your private bug reports mean nothing. Only public shaming helps here. https://medium.com/@lemiorhan/the-story-behi

by sccxy 9y ago

Real problem is that if you are nobody then your private bug reports mean nothing. Only public shaming helps here. https://medium.com/@lemiorhan/the-story-behind-anyone-can-login-as-root-tweet-33731b5ded71 https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo... Author of this tweet said that Apple was informed at least week before tweet, but zero response.

londons_explore 9y ago
Lots of companies are quite good at handling security vulnerabilities, but somehow still neglect to reply to the original reporter. Usually there's a long chain of people involved in creating tickets, allocating resources, finding the bug, fixing the bug, QA, release processes, documenting the problem, making security bulletins, translating security bulletins, etc. Each of those people communicates via internal processes the reporter doesn't have access to, and none of them think to ping the original reporter saying 'yo - bugfix complete, qa next, then release'
deleted 9y ago
[deleted]
pkamb 9y ago
> On Nov 23, the staff members informed Apple about it. For everyone kvetching yesterday about "responsible disclosure".