4 ms·

Security through obscurity is is not useless, but its not much protection either. There are virtually countless open source projects with public bug tracking, m

by xnyan 8y ago

Security through obscurity is is not useless, but its not much protection either. There are virtually countless open source projects with public bug tracking, many of which are highly public critical internet facing applications used by millions.

donarb 8y ago
It's not necessarily security through obscurity. It's more of a privacy thing and prevents companies from mining bug reports for information about what types of software competitors are working on. Bug reports also contain code and projects that help Apple find the cause of a bug.
- TheDong 8y ago
  The simple solution is a two-tiered system. The submitter can check "This report is security sensitive or has confidential information that should not be shared further than necessary to fix the bug." Most projects have this in the form of a default-public bug tracker, and private emails to the developer or security@ mailing list. It's not difficult to have both private and public bugs where the submitter chooses which is appropriate.
  - natch 8y ago
    I love it when people think they know better than Apple, and propose simplistic non-solutions as solutions, as if some amazing people at Apple had not already spent countless hours thinking this through at a deep level. The submitter doesn't always know when they are submitting sensitive or confidential information. And that's not going to be fixed any time soon or with any simple solution. There are system diagnostics reports that can be many megabytes and contain potentially confidential information, and it would be entirely unreasonable to expect a user, even a developer user, to know how to trawl through all of these reports with a level of expertise to discern every possible case of leakage. And that's just the personal / private information... which, by the way, Apple from what I've seen seems to strive to keep OUT of the diagnostic reports, but that doesn't mean they are perfect at this. And that doesn't even begin to address the information that might be, totally unknown to the submitter, exploitable in other ways. As far as what other projects have, macOS is a highly complex operating system along with a tightly integrated ecosystem of apps and services, which is designed to, and relied on to, "just work"... while most other systems are either much smaller, or are not maintaining a level of smooth operation and security that can match the "it just works" level of reliability standard that macOS aims for. So maybe the bug reporting systems of all those other projects are appropriate for those other projects, but that doesn't make those systems and their practices appropriate for macOS.
natch 8y ago
I wasn't talking about security through obscurity, so regurgitating that point helps nothing. It is typical in the industry to keep exploit information under wraps until it is fixed. And the other part of my comment was about personal and private information. Those countless open source projects aren't up to the same standard as macOS in terms of a combination of complexity plus the expectation of "it just works"... note I said the combination of these two things, not just one of them at a time.

by xnyan 8y ago

donarb 8y ago

It's not necessarily security through obscurity. It's more of a privacy thing and prevents companies from mining bug reports for information about what types of software competitors are working on. Bug reports also contain code and projects that help Apple find the cause of a bug.

TheDong 8y ago
The simple solution is a two-tiered system. The submitter can check "This report is security sensitive or has confidential information that should not be shared further than necessary to fix the bug." Most projects have this in the form of a default-public bug tracker, and private emails to the developer or security@ mailing list. It's not difficult to have both private and public bugs where the submitter chooses which is appropriate.
- natch 8y ago
  I love it when people think they know better than Apple, and propose simplistic non-solutions as solutions, as if some amazing people at Apple had not already spent countless hours thinking this through at a deep level. The submitter doesn't always know when they are submitting sensitive or confidential information. And that's not going to be fixed any time soon or with any simple solution. There are system diagnostics reports that can be many megabytes and contain potentially confidential information, and it would be entirely unreasonable to expect a user, even a developer user, to know how to trawl through all of these reports with a level of expertise to discern every possible case of leakage. And that's just the personal / private information... which, by the way, Apple from what I've seen seems to strive to keep OUT of the diagnostic reports, but that doesn't mean they are perfect at this. And that doesn't even begin to address the information that might be, totally unknown to the submitter, exploitable in other ways. As far as what other projects have, macOS is a highly complex operating system along with a tightly integrated ecosystem of apps and services, which is designed to, and relied on to, "just work"... while most other systems are either much smaller, or are not maintaining a level of smooth operation and security that can match the "it just works" level of reliability standard that macOS aims for. So maybe the bug reporting systems of all those other projects are appropriate for those other projects, but that doesn't make those systems and their practices appropriate for macOS.

natch 8y ago

I wasn't talking about security through obscurity, so regurgitating that point helps nothing. It is typical in the industry to keep exploit information under wraps until it is fixed. And the other part of my comment was about personal and private information. Those countless open source projects aren't up to the same standard as macOS in terms of a combination of complexity plus the expectation of "it just works"... note I said the combination of these two things, not just one of them at a time.