3 ms·
>If you report a vulnerability affecting Apple products, Apple will provide you with a publication date... Until the publication date, you cannot discuss the vu
by shantara 6y ago
>If you report a vulnerability affecting Apple products, Apple will provide you with a publication date... Until the publication date, you cannot discuss the vulnerability with others.
In addition to the mandatory bug reporting, Apple reserve a right to dictate the researchers a mandatory publication date. No more 90/180 days responsible disclosure deadline policy. I highly doubt any serious researcher would agree to work with such conditions.
- saagarjha 6y agoWould be interesting to see if Google Project Zero joins the program, given their inflexibility in disclosure.
- shantara 6y agoThat's what I've been thinking about as well. I'm leaning towards "no", but let's wait and see.
- bobviolier 6y agoLooks like they won't https://twitter.com/benhawkes/status/1286021329246801921?s=19 https://twitter.com/benhawkes/status/1286021329246801921?s=1...