3 ms·

I imagine they are just overwhelmed. Let’s say they have a team of 6 engineers tasked with this. They probably receive hundreds of reports a day, many bogus, s

I imagine they are just overwhelmed. Let’s say they have a team of 6 engineers tasked with this. They probably receive hundreds of reports a day, many bogus, some real, but all long winded descriptions like this framed to make the vuln seem as bad as possible. In addition many vuln reports are generated by automated tools and sprayed to thousands of sites/vendors daily in the hope of one of them paying out, they seem coherent at first glance but are often nonsense or not really a vuln at all, and of course there are many duplicates or near duplicates. If each of these takes 20 mins to triage, 1 hour to properly look at and days to confirm, you can see how a team of any reasonable size would soon be completely submerged and unable to respond to anything but the most severe and succinct vulnerability reports in a timely way.

ninth_ant 5y ago
I feel like Apple could afford to staff a security program like this. Much, much smaller and less wealthy companies manage it.
- raylu 5y ago
  much smaller, less wealthy companies attract far fewer reports
moonchrome 5y ago
I don't buy this. They fixed one reported, got back to him and acknowledge the lack of disclosure, apologised, promised to fix it and never actually disclosed it 3 reports later. It's not a case of "someone missed this" it's "this seems dysfunctional".
EMM_386 5y ago
> Let’s say they have a team of 6 engineers tasked with this. They are a trillion dollar company. They can have as many engineers as they'd like.
- grey-area 5y ago
  You'd probably be surprised how small some departments are at large companies, if they're seen as a cost centre rather than a profit centre. I agree they could and should do a lot better, I'm just imagining the probable reasons for this level of dysfunction - the most likely explanation to me is an overwhelmed, overworked department submerged in so many requests that they can't filter out the useful ones or respond in a timely way. Just as one other example of this, the bug reporting system at Apple is antiquated and seen as a black hole outside the company, probably again due to underinvestment.

ninth_ant 5y ago

I feel like Apple could afford to staff a security program like this. Much, much smaller and less wealthy companies manage it.

raylu 5y ago
much smaller, less wealthy companies attract far fewer reports

moonchrome 5y ago

I don't buy this. They fixed one reported, got back to him and acknowledge the lack of disclosure, apologised, promised to fix it and never actually disclosed it 3 reports later. It's not a case of "someone missed this" it's "this seems dysfunctional".

EMM_386 5y ago

> Let’s say they have a team of 6 engineers tasked with this. They are a trillion dollar company. They can have as many engineers as they'd like.

grey-area 5y ago
You'd probably be surprised how small some departments are at large companies, if they're seen as a cost centre rather than a profit centre. I agree they could and should do a lot better, I'm just imagining the probable reasons for this level of dysfunction - the most likely explanation to me is an overwhelmed, overworked department submerged in so many requests that they can't filter out the useful ones or respond in a timely way. Just as one other example of this, the bug reporting system at Apple is antiquated and seen as a black hole outside the company, probably again due to underinvestment.