3 ms·
There are a couple odd gaps that seem to be been in place at Apple. First, Apple did not even acknowledge the report to the initial finder. This is flawed, lik
by kerng 8y ago
There are a couple odd gaps that seem to be been in place at Apple.
First, Apple did not even acknowledge the report to the initial finder. This is flawed, like Google, Microsoft and other big players acknowledge receipt.
Secondly, the person tried to go beyond after not hearing anything, by calling, faxing and other means to no avail.
Third, Apple needs to staff their responders better it seems. Most issues can be filtered out quickly to be left with the few interesting ones. The repro here doesnt need any technical knowledge!
Many companies outsource the initial triage process even to have it scale when needed.
So, one take away for Apple is to improve their response process and transparency. Transparency they have always lacked when it comes to security.
- duxup 8y ago>First, Apple did not even acknowledge the report to the initial finder. That is strange. I worked with some folks who interacted with researchers and their reports. Half the battle with them was getting back to the researcher and getting their cooperation about keeping quiet + assuring them they're working on it, and working with them if additional data is needed. And at the same time fending off internal folks who have poor instincts and want to push back against, blame, or even punish the researcher (this was surprisingly common at companies who even should know better). It's not the hardest part but developing that trust can be a big difference between a possible PR nightmare or not, and the initial contacts are a big deal. Also researcher's who you get along with sometimes come back with better data, additional bugs,etc.
- olliej 8y agoHow long is reasonable? Consider the number of incoming bugs, etc
- kerng 8y agoWith a standard case management system this can (and is at other companies) automated - so maybe an hour max for an acknowledgement that a case got created? It sounds like Apple might be doing do this all via email, no case management software. That would be pretty bad.
- olliej 8y agoNo, everything is tracked. apple uses radar (an internal tracking system). You can’t automate handling of bug submissions unless they’re semi automated (crash reports , spintracer, etc get coalesced, and high volume ones get higher priority). But people filing bugs themselves? That goes through triage to filter out unactionable bugs and send to correct engineering teams. Those then gets screen by either (if the team is big enough) and dedicated screener, to the right sub component or engineer. That all takes time, and is unavoidable