5 ms·
Whenever I read an independent disclosure in an area I'm unfamiliar with such as this, involving the failure of the vendor to engage with the security researche
by Ansil849 6y ago
Whenever I read an independent disclosure in an area I'm unfamiliar with such as this, involving the failure of the vendor to engage with the security researcher , I'm always presented with a parsing dilemma: is the vendor justified in ignoring the exploit because it is not really as severe as the author makes it out to be - or is the author correct and this is a serious vulnerability which the vendor has ignored/let slip through the cracks?
- _qulr 6y agoI'm not even claiming the vulnerability is serious. But when there's a bug bounty involved, the question is whether the vendor is ever going to pay, or the vendor is just leading the bug reporter on to keep it quiet for as long as possible.
- _qulr 6y agoApple doesn't pay a bounty until after they release a fix. So if Apple decided to de-prioritize a bug, you never get paid. But Apple doesn't tell if you they've de-prioritized a bug, they just want you to remain silent forever, and they say "We're still investigating."
- searchableguy 6y agoI don't understand how big companies are always penny-pinchers in this area. Anyone got a glue?
- Ansil849 6y agoMy armchair theory is that there is a bit of hubris involved: in-house developers are hesitant to admit they've been 'bested' by a stranger on the internet, and so downplay or even just have blinders on against recognizing in the first place the severity of the issue. Though to be far, I think the flipside is also at times true - where the independent security researcher believes the anthill they've found is a mountain.