3 ms·

Dear god... Come on Apple, if that's all true that's pretty stupid/shitty of Apple. I guess maybe anyone filling bug bounty reports probably has a developer acc

Dear god... Come on Apple, if that's all true that's pretty stupid/shitty of Apple. I guess maybe anyone filling bug bounty reports probably has a developer account so it's not a big deal? Also it's not clear if they mean a paid account or a free one. I'm guessing they just needed a way to let her submit the issue and open a dialog via their existing tools and workflows but maybe I'm being too generous to Apple.

jrochkind1 8y ago
I mean, I'm sure that's what they were thinking. The fact remains that they have no suitable process for a non-developer to give them a vulnerability report that they pay attention to. She seems to have tried really hard, without having the background to know the 'right' way. You gotta have a way for people who don't know the 'right' way to submit and have it get somewhere, right? Without having to try really hard. They're doing you a favor. > To report security or privacy issues that affect Apple products or web servers, please contact product-security@apple.com You think "emailing apple's security team", which the NYT says she did, was emailing that address? I'm guessing it was, and apparently it didn't actually result in anyone paying attention. The email address they advertise as being the place to report security issues.... If they actually want/need people to create developer accounts and use a tool there, maybe they should say that and not give an email address apparently nobody pays attention to...