4 ms·

[deleted]

• murderfs 8y ago
  Why do you expect some random member of the public to obey an arbitrary rule from the infosec community that they don't even all agree on?
  • CGamesPlay 8y ago
    Oh I don't. I expect Apple to hold their bug reporters to those standards, though, so it's interesting to see that they are giving a "bounty" to this "irresponsible disclosure".
    • pfg 8y ago
      How was the disclosure irresponsible? AIUI, multiple attempts were made to report the bug. It went viral a couple of days later on social media. I'm not aware of a link between those two events.
• simion314 8y ago
  Do you know how difficult it is to get into a bounty program?
• GranPC 8y ago
  Huh? Group calls were not a new feature, and the teen's mother made several attempts to disclose it privately to Apple, including registering for a developer account and submitting a bug from there. I'm pretty sure that's as close as "responsible disclosure" as you can get.
  • bdcravens 8y ago
    > Group calls were not a new feature This bug affected Group FaceTime, which was added in 12.1 (released in October)
• cowsandmilk 8y ago
  > the guy didn’t report it responsibly What? As far as I understand, with his mom, he attempted to report it to the product-security email Apple tells you to do, they were brushed off and told to file radars, which they then did. And nothing happened. So, yes, he reported it responsibly and was ignored... traditionally, that's when security researchers say you move to reporting it via more public means...