5 ms·

Apple has a dedicated team that triages incoming security vulnerability reports. If you search for how to report a security issue to Apple, you would find their

Apple has a dedicated team that triages incoming security vulnerability reports. If you search for how to report a security issue to Apple, you would find their e-mail address. The weird thing to me is that the NYT article says that she tried "faxing Apple’s security team." Having some familiarity with the team and the process of reporting security vulnerabilities to them, I do not recall them ever claiming to have a fax machine. The idea of Apple asking you to fax in a bug report is ludicrous.

olliej 8y ago
For it to reach that screening step it has to be tagged as security bug. Do you really think a consumer would think to do that? Also you have to consider the number of bugs that are incorrectly flagged as being security.
- saagarjha 8y ago
  I'm sure reports to product-security@apple.com get immediately flagged as "security".
  - bostik 8y ago
    Knowing how much outright spam a security email address gets... (luckily spam filtering is good enough to not surface them but a human still has to periodically go through the spams just to ensure there were no false positives) Even then, the modern day incentives around vulnerability disclosure are not helping. Because security bugs are awarded bounties based on their severity, every single reporter has a financial incentive to hype and inflate their findings. "URGENT" this, "CRITICAL" that, "ACCOUNT TAKEOVER" due to already compromised computer/device, you name it. Teams without sufficient resources will spend a lot of time dealing with the maladjusted severities. And yes, I believe the "mal-" prefix is warranted. If your report does go through with inflated severity, you stand to make more money. I am starting to think that a reasonably run bounty programme should state up front that inflated severities in bug reports will reduce their payouts.
  - olliej 8y ago
    I thought it was filed through the standard external bug report tool? (The PS queue is higher priority, but I assume also gets huge amounts of spam)
yalok 8y ago
That teen’s mom is a lawyer. There’s still something legal-binding about faxes that Email doesn’t have. At my former employer, we (a remote office for mother company) were sometimes told to send some info via a real fax and there were no ways around it (other than overnighting the original). Also, it’s amazing to see she did so much to try to notify them. Yes, not being technical, she couldn’t figure out that security team email, but I wonder why all of the Apple people who were getting signals from her didn’t forward it to that team...
- octocode 8y ago
  The sender can confirm that a fax has been received correctly on the other end. It will even print out a confirmation page with "message completely received". Can't do the same with emails, so there's no pretending you never received it because it was caught in some filter somewhere outside of your control. Overnighting is similar in that the carrier should provide confirmation that a package has been successfully delivered.
  - stock_toaster 8y ago
    Unrelated to anything, but... There are many fax vendors (sfax for example), that provide "virtual fax machines", and that email you received faxes. Those emails could get lost. The fax service could lose the data. Just because a fax was received by a "fax machine", doesn't necessarily mean someone actually got it. Certified mail is probably a better "someone received it" option, if that is the desired requirement.
    - adrianN 8y ago
      I'd expect that you can then sue the fax vendor?
      - stock_toaster 8y ago
        Probably something in the ToS about forced arbitration or "best effort delivery", with how things go these day. :/

olliej 8y ago

For it to reach that screening step it has to be tagged as security bug. Do you really think a consumer would think to do that? Also you have to consider the number of bugs that are incorrectly flagged as being security.

saagarjha 8y ago
I'm sure reports to product-security@apple.com get immediately flagged as "security".
- bostik 8y ago
  Knowing how much outright spam a security email address gets... (luckily spam filtering is good enough to not surface them but a human still has to periodically go through the spams just to ensure there were no false positives) Even then, the modern day incentives around vulnerability disclosure are not helping. Because security bugs are awarded bounties based on their severity, every single reporter has a financial incentive to hype and inflate their findings. "URGENT" this, "CRITICAL" that, "ACCOUNT TAKEOVER" due to already compromised computer/device, you name it. Teams without sufficient resources will spend a lot of time dealing with the maladjusted severities. And yes, I believe the "mal-" prefix is warranted. If your report does go through with inflated severity, you stand to make more money. I am starting to think that a reasonably run bounty programme should state up front that inflated severities in bug reports will reduce their payouts.
- olliej 8y ago
  I thought it was filed through the standard external bug report tool? (The PS queue is higher priority, but I assume also gets huge amounts of spam)

yalok 8y ago

That teen’s mom is a lawyer. There’s still something legal-binding about faxes that Email doesn’t have. At my former employer, we (a remote office for mother company) were sometimes told to send some info via a real fax and there were no ways around it (other than overnighting the original). Also, it’s amazing to see she did so much to try to notify them. Yes, not being technical, she couldn’t figure out that security team email, but I wonder why all of the Apple people who were getting signals from her didn’t forward it to that team...

octocode 8y ago
The sender can confirm that a fax has been received correctly on the other end. It will even print out a confirmation page with "message completely received". Can't do the same with emails, so there's no pretending you never received it because it was caught in some filter somewhere outside of your control. Overnighting is similar in that the carrier should provide confirmation that a package has been successfully delivered.
- stock_toaster 8y ago
  Unrelated to anything, but... There are many fax vendors (sfax for example), that provide "virtual fax machines", and that email you received faxes. Those emails could get lost. The fax service could lose the data. Just because a fax was received by a "fax machine", doesn't necessarily mean someone actually got it. Certified mail is probably a better "someone received it" option, if that is the desired requirement.
  - adrianN 8y ago
    I'd expect that you can then sue the fax vendor?
    - stock_toaster 8y ago
      Probably something in the ToS about forced arbitration or "best effort delivery", with how things go these day. :/