8 ms·

Responsible disclosure would have been to product-security@apple.com. Do apple have a bug-bounty program?

by mappu 9y ago

deleted 9y ago
[deleted]
q3k 9y ago
They don't for macOS. And the iOS one is invite-only.
- j1vms 9y ago
  > They don't for macOS. And the iOS one is invite-only. Which may, unfortunately, speak to what management thinks about the security/quality of the macOS codebase. I wouldn't be surprised the recent and upcoming exploits lead Apple to increase iOS dominance over its future product pipeline.
  - infamouscow 9y ago
    Apple's financial reports and behavior the last few years make it clear their priorities are not with the Mac, but with iOS. For better or worse, Apple is a smartphone company that happens to make computers on the side.
    - yeukhon 9y ago
      > For better or worse, Apple is a smartphone company that happens to make computers on the side. Apple makes computer and operating system way before it entered the mobile market. The first part is right, but your second part is inaccurate historically.
      - apecat 9y ago
        Yeah but to phrase it pointedly, to what degree does Apple consider Macs to be basically development kits for iOS apps? It's very clear that iPhones make the big cash.
    - baq 9y ago
      It's not even an electronics company anymore, is a luxury goods company.
  - yeukhon 9y ago
    This is stupid though. macOS is the operating system for its flagship desktop/laptop devices. The lack of bug bounty on macOS (or even an invite one) seems really bizarre.
gok 9y ago
Why do that when you can wreck a security engineer’s vacation?
- mtgx 9y ago
  On the other hand, it could teach a good lesson on technical debt?
  - ajmurmann 9y ago
    I would claim that there is a very high likelihood that the person having to work all night to fix this on new years Eve is not the same person who prioritizes tech debt pay off vs. new features.
- floatingatoll 9y ago
  Why would your security engineer take CVE-2008-0001 as a holiday?
- Narkov 9y ago
  Can a company the size of Apple not afford 24x7 security resources? For their installed user-base, I don't think this is unreasonable. Security doesn't have a holiday.
aNoob7000 9y ago
I don't understand why Apple doesn't have a well-funded bug bounty program. You would think that companies would welcome people finding bugs in their software. Hell, they could give away free MacBook Pro laptops, phones, and IPads along with CASH!!!
- bardworx 9y ago
  I agree. Considering that giving away a dev style laptop would be a nice reward, it’s weird that they do not leverage their products as reward. High spec MBP + some cash goes a long way. Even engrave the freaking laptop to make it “sough after”.
- mwfunk 9y ago
  They do have a well-funded and well-publicized bounty program for security exploits.
  - caio1982 9y ago
    Would you agree that if it were really well known and earned a fair amount to hackers people would not end up throwing this stuff online (even on Twitter) because their PR team is the only one that gets affected in these cases?
  - mappu 9y ago
    Apple's bug bounty program does not cover macOS.
  - GordonS 9y ago
    ... for iOS
emmelaich 9y ago
No mention of disclosure, reporting, or CVE in the entire article :-(
- abhorrence 9y ago
  That's why they're calling it a 0day, because they haven't done any of those things.
- newfoundglory 9y ago
  No, but it's in the thread https://news.ycombinator.com/item?id=16044060 https://news.ycombinator.com/item?id=16044060
tptacek 9y ago
"Responsible Disclosure" is an Orwellian term concocted by vendors to control the actions of independent vulnerability researchers who work without real compensation, using information freely available to consumers, in competition with malicious attackers. The term you're looking for is "Coordinated Disclosure". Yes, Coordinated Disclosure would involve sending the bug to Apple and waiting for them to publish it. If you'd like to complain that this disclosure is irresponsible, fine. But try not to do it using the vendor's marketing term, because it's not up to them to decide what is and isn't "responsible". Other reasonable people --- myself included --- will probably disagree with you, and say that getting information out to people as comprehensively as possible is usually the most responsible thing you can do with a security bug.
- jph 9y ago
  Coordinated disclosure information is here, and edits/suggestions/feedback are welcome: http://github.com/joelparkerhenderson/coordinated_disclosure http://github.com/joelparkerhenderson/coordinated_disclosure
- gok 9y ago
  So a disclosure can be irresponsible but don’t call it an irresponsible disclosure?
  - dpwm 9y ago
    The "responsible" disclosure term is a pretty devious piece of marketing, because it creates situations such as this very thread. Its use carries an implicit catch that anything that does not meet the narrow definitions of "responsible" is the opposite. Without naming names there are vendors that have been pretty terrible at handling their end of "responsible" disclosure and appear to be getting worse, down to not even acknowledging there is a problem or even that they have been notified of a problem. The alternative to disclosing a vulnerability is non-disclosure and, frankly, that's what some vendors mean when they say "responsible".
- tensor 9y ago
  I don't like the term you made up. But fine, I think this is "Irresponsible Disclosure." Is that better? Did anything change? Vendors and non-vendors alike are all responsible for good security, and that includes working together to make this happen. If you are working against vendors because of some preconceived notion that they are "evil," that's not a good thing. If it turns out that the author did submit to the vendor and worked together to minimize damage then I'll retract my statement. Until then I think it's irresponsible, not just "uncoordinated".
bangonkeyboard 9y ago
"...turned out Apple PR channel is much more responsive than product security [...] No wonder nowadays people just throw security issues on Twitter right? What a world we live in." — https://medium.com/@khaost/your-home-was-not-so-secure-after-all-af52fbd6777c https://medium.com/@khaost/your-home-was-not-so-secure-after...
tzahola 9y ago
Maybe if more people would disclose such vulnerabilities “irresponsibly”, vendors would develop their software more responsibly. Just my 2 cents ¯\_(ツ)_/¯
- azinman2 9y ago
  Unlikely. Security is hard, and a complex product like an OS and all it’s support programs creates a ton of surface area for attack.
FRex 9y ago
Comments like these really rub me the wrong way. If it were some other company that actually has such a program or isn't as evil and uncooperative in so many aspects as Apple I could even agree to the sentiment (but not the wording). But as noted in the comments - they do fucking not for Mac OS. As noted in other comments - they knew about this bug anyway for a while now and it requires local code execution first to do anything anyway. They deny problems until a shit tornado actually starts somewhere and they absolutely love to control the narrative. They are clearly PR first, lobby and fight against right-to-repair efforts because they want to "guarantee the quality of authorized repair", sell expensive proprietary software on proprietary hardware (ostensibly to provide absolute perfection by controlling the entire stack), have slogans like "it just works", "light years ahead", "touch of genius", "say hello to the future", care enough about current social outrages (USA specific ones that is..) to do truly silly crap like water pistol emoji or removing a historic game that featured a confederate flag. They are also secretive as hell (i.e. 0 social media presence/interaction, YouTube comments off on their channel to prevent criticism, engineers under stricter NDA compared to Google, Microsoft, etc.), instantly fired an engineer for a mere iPhone X video her daughter filmed in Cupertino Campus, actually sent police to raid a house of a Gizmodo reporter and confiscate his stuff (which apparently breaks journalist protection laws both federal and state but oh well, it's USA and Apple, money talks, bullshit walks) when they wrote about a leaked iPhone 4G prototype, ran idiotic misinforming (but funny, so apparently it's okay!) ads in the past like the "Macs don't get viruses" one but still managed to have bugs like infamous "goto fail" or "password got stored in hint" (which are frankly insane to me). If they cared they could do as much as silently toss a few thousand dollars per big bug, make sentimental/bragging right's rewards (like Knuth's cheques), etc. but chose not to. They should be thankful that between "sell 0 days on the dark net", "do what Apple says for free" and "post online for cred" actual security hackers pick the last and not the first (I mean, I also would out of principle of not being a criminal, but there is clearly something wrong with a company's image if we have to fall back to a person's moral compass or even criminal justice system for any choice). To add to the problem a lot of their fans are outright rabid, instantly plunder the Apple stores at each product release and criticizing Apple anywhere near them online results in being called a Microsoft/Android shill, hater, poor, fucker, faggot and such, and Apple's PR fluff being regurgitated at you. If someone lives lavishly in a multi-billion ivory tower that also has a diamond mine under it while surrounded by their cultists and won't even toss you leftovers when you help them out, what do they expect? They are a crazily rich, global and long established company and they should stop being excused. They are the world pinnacle of technology business in every sense and if they can't deliver they deserve the criticism. The poor guys working for free on OpenSSL for a bazillion platforms for single digit k of donations per year (and 0 compensation from all the corporate freeloaders from Fortune 500) got torn a new asshole the size of La Manche for HeartBleed but Apple keeps getting excused for not being able to get their shit together (by their own wish, like not having a bug bounty after all the bugs that happened in 2017) while they have the opinion of saints and geniuses and control everything to the tiniest details - shops, repairs, hardware, software, components and information.
contras1970 9y ago
that would have been a withholder, not disclosure. you need to disclose the vulnerability to those who are vulnerable for it to be disclosure, and nothing else is responsible.

Responsible disclosure would have been to product-security@apple.com. Do apple have a bug-bounty program?

by mappu 9y ago

Responsible disclosure would have been to product-security@apple.com. Do apple have a bug-bounty program?

deleted 9y ago

[deleted]

q3k 9y ago

They don't for macOS. And the iOS one is invite-only.

j1vms 9y ago
> They don't for macOS. And the iOS one is invite-only. Which may, unfortunately, speak to what management thinks about the security/quality of the macOS codebase. I wouldn't be surprised the recent and upcoming exploits lead Apple to increase iOS dominance over its future product pipeline.
- infamouscow 9y ago
  Apple's financial reports and behavior the last few years make it clear their priorities are not with the Mac, but with iOS. For better or worse, Apple is a smartphone company that happens to make computers on the side.
  - yeukhon 9y ago
    > For better or worse, Apple is a smartphone company that happens to make computers on the side. Apple makes computer and operating system way before it entered the mobile market. The first part is right, but your second part is inaccurate historically.
    - apecat 9y ago
      Yeah but to phrase it pointedly, to what degree does Apple consider Macs to be basically development kits for iOS apps? It's very clear that iPhones make the big cash.
  - baq 9y ago
    It's not even an electronics company anymore, is a luxury goods company.
- yeukhon 9y ago
  This is stupid though. macOS is the operating system for its flagship desktop/laptop devices. The lack of bug bounty on macOS (or even an invite one) seems really bizarre.

gok 9y ago

Why do that when you can wreck a security engineer’s vacation?

mtgx 9y ago
On the other hand, it could teach a good lesson on technical debt?
- ajmurmann 9y ago
  I would claim that there is a very high likelihood that the person having to work all night to fix this on new years Eve is not the same person who prioritizes tech debt pay off vs. new features.
floatingatoll 9y ago
Why would your security engineer take CVE-2008-0001 as a holiday?
Narkov 9y ago
Can a company the size of Apple not afford 24x7 security resources? For their installed user-base, I don't think this is unreasonable. Security doesn't have a holiday.

aNoob7000 9y ago

I don't understand why Apple doesn't have a well-funded bug bounty program. You would think that companies would welcome people finding bugs in their software. Hell, they could give away free MacBook Pro laptops, phones, and IPads along with CASH!!!

bardworx 9y ago
I agree. Considering that giving away a dev style laptop would be a nice reward, it’s weird that they do not leverage their products as reward. High spec MBP + some cash goes a long way. Even engrave the freaking laptop to make it “sough after”.
mwfunk 9y ago
They do have a well-funded and well-publicized bounty program for security exploits.
- caio1982 9y ago
  Would you agree that if it were really well known and earned a fair amount to hackers people would not end up throwing this stuff online (even on Twitter) because their PR team is the only one that gets affected in these cases?
- mappu 9y ago
  Apple's bug bounty program does not cover macOS.
- GordonS 9y ago
  ... for iOS

emmelaich 9y ago

No mention of disclosure, reporting, or CVE in the entire article :-(

abhorrence 9y ago
That's why they're calling it a 0day, because they haven't done any of those things.
newfoundglory 9y ago
No, but it's in the thread https://news.ycombinator.com/item?id=16044060 https://news.ycombinator.com/item?id=16044060

tptacek 9y ago

"Responsible Disclosure" is an Orwellian term concocted by vendors to control the actions of independent vulnerability researchers who work without real compensation, using information freely available to consumers, in competition with malicious attackers. The term you're looking for is "Coordinated Disclosure". Yes, Coordinated Disclosure would involve sending the bug to Apple and waiting for them to publish it. If you'd like to complain that this disclosure is irresponsible, fine. But try not to do it using the vendor's marketing term, because it's not up to them to decide what is and isn't "responsible". Other reasonable people --- myself included --- will probably disagree with you, and say that getting information out to people as comprehensively as possible is usually the most responsible thing you can do with a security bug.

jph 9y ago
Coordinated disclosure information is here, and edits/suggestions/feedback are welcome: http://github.com/joelparkerhenderson/coordinated_disclosure http://github.com/joelparkerhenderson/coordinated_disclosure
gok 9y ago
So a disclosure can be irresponsible but don’t call it an irresponsible disclosure?
- dpwm 9y ago
  The "responsible" disclosure term is a pretty devious piece of marketing, because it creates situations such as this very thread. Its use carries an implicit catch that anything that does not meet the narrow definitions of "responsible" is the opposite. Without naming names there are vendors that have been pretty terrible at handling their end of "responsible" disclosure and appear to be getting worse, down to not even acknowledging there is a problem or even that they have been notified of a problem. The alternative to disclosing a vulnerability is non-disclosure and, frankly, that's what some vendors mean when they say "responsible".
tensor 9y ago
I don't like the term you made up. But fine, I think this is "Irresponsible Disclosure." Is that better? Did anything change? Vendors and non-vendors alike are all responsible for good security, and that includes working together to make this happen. If you are working against vendors because of some preconceived notion that they are "evil," that's not a good thing. If it turns out that the author did submit to the vendor and worked together to minimize damage then I'll retract my statement. Until then I think it's irresponsible, not just "uncoordinated".

bangonkeyboard 9y ago

"...turned out Apple PR channel is much more responsive than product security [...] No wonder nowadays people just throw security issues on Twitter right? What a world we live in." — https://medium.com/@khaost/your-home-was-not-so-secure-after-all-af52fbd6777c https://medium.com/@khaost/your-home-was-not-so-secure-after...

tzahola 9y ago

Maybe if more people would disclose such vulnerabilities “irresponsibly”, vendors would develop their software more responsibly. Just my 2 cents ¯\_(ツ)_/¯

azinman2 9y ago
Unlikely. Security is hard, and a complex product like an OS and all it’s support programs creates a ton of surface area for attack.

FRex 9y ago

Comments like these really rub me the wrong way. If it were some other company that actually has such a program or isn't as evil and uncooperative in so many aspects as Apple I could even agree to the sentiment (but not the wording). But as noted in the comments - they do fucking not for Mac OS. As noted in other comments - they knew about this bug anyway for a while now and it requires local code execution first to do anything anyway. They deny problems until a shit tornado actually starts somewhere and they absolutely love to control the narrative. They are clearly PR first, lobby and fight against right-to-repair efforts because they want to "guarantee the quality of authorized repair", sell expensive proprietary software on proprietary hardware (ostensibly to provide absolute perfection by controlling the entire stack), have slogans like "it just works", "light years ahead", "touch of genius", "say hello to the future", care enough about current social outrages (USA specific ones that is..) to do truly silly crap like water pistol emoji or removing a historic game that featured a confederate flag. They are also secretive as hell (i.e. 0 social media presence/interaction, YouTube comments off on their channel to prevent criticism, engineers under stricter NDA compared to Google, Microsoft, etc.), instantly fired an engineer for a mere iPhone X video her daughter filmed in Cupertino Campus, actually sent police to raid a house of a Gizmodo reporter and confiscate his stuff (which apparently breaks journalist protection laws both federal and state but oh well, it's USA and Apple, money talks, bullshit walks) when they wrote about a leaked iPhone 4G prototype, ran idiotic misinforming (but funny, so apparently it's okay!) ads in the past like the "Macs don't get viruses" one but still managed to have bugs like infamous "goto fail" or "password got stored in hint" (which are frankly insane to me). If they cared they could do as much as silently toss a few thousand dollars per big bug, make sentimental/bragging right's rewards (like Knuth's cheques), etc. but chose not to. They should be thankful that between "sell 0 days on the dark net", "do what Apple says for free" and "post online for cred" actual security hackers pick the last and not the first (I mean, I also would out of principle of not being a criminal, but there is clearly something wrong with a company's image if we have to fall back to a person's moral compass or even criminal justice system for any choice). To add to the problem a lot of their fans are outright rabid, instantly plunder the Apple stores at each product release and criticizing Apple anywhere near them online results in being called a Microsoft/Android shill, hater, poor, fucker, faggot and such, and Apple's PR fluff being regurgitated at you. If someone lives lavishly in a multi-billion ivory tower that also has a diamond mine under it while surrounded by their cultists and won't even toss you leftovers when you help them out, what do they expect? They are a crazily rich, global and long established company and they should stop being excused. They are the world pinnacle of technology business in every sense and if they can't deliver they deserve the criticism. The poor guys working for free on OpenSSL for a bazillion platforms for single digit k of donations per year (and 0 compensation from all the corporate freeloaders from Fortune 500) got torn a new asshole the size of La Manche for HeartBleed but Apple keeps getting excused for not being able to get their shit together (by their own wish, like not having a bug bounty after all the bugs that happened in 2017) while they have the opinion of saints and geniuses and control everything to the tiniest details - shops, repairs, hardware, software, components and information.

contras1970 9y ago

that would have been a withholder, not disclosure. you need to disclose the vulnerability to those who are vulnerable for it to be disclosure, and nothing else is responsible.