3 ms·

Yeah so if he did as he claimed then he achieved the bypass Apple claims to be paying for. Now if Apple is lying and refusing to honour their bug bounty, that i

Yeah so if he did as he claimed then he achieved the bypass Apple claims to be paying for. Now if Apple is lying and refusing to honour their bug bounty, that is another matter. My point is that just because you can get the user to execute your malicious executable under their user account does not grant you access to all their files, unlike what you would expect with traditional Unix permissions.

lostcolony 5y ago
Your point is taken, but also irrelevant to the specifics laid out in the article. I appreciate that "normally" the user may have to allow access to files and things (I'm not sure I've ever experienced that on a Mac before when installing applications; I installed Sublime and could open and edit files without any user dialogs, but maybe I disabled something, or working through the UI behaves differently or whatever), but the whole point being made is what the hacker says in the article would indicate it should have claimed the bounty.