4 ms·
The lesson I would take away from this is that Apple should provide a mechanism for security vulnerabilities to be reported officially so that researchers don't
by 5hoom 15y ago
The lesson I would take away from this is that Apple should provide a mechanism for security vulnerabilities to be reported officially so that researchers don't have to engage in these sort of dubious activities.
Whether they listen to the reports or not is another matter.
Anyway, is there any special reason why reporting via https://ssl.apple.com/support/security/ https://ssl.apple.com/support/security/ won't work?
- nookiemonster 15y agoCharlie is one of the founders of the controversial "no more free bugs" movement. The amount of skill necessary to identify AND exploit bugs is so great that the bug reports themselves have value,far beyond attribution in the patch notesand a T-Shirt. This is especially true when there is in fact a lack market of bad people willing to pay good money for 0 day vulns. thus, reporting vulns that way doesnt necessarily make sense. Charlie's walking a fine line: He is not a BadGuy, but he also isn't giving away security consulting to companies with 200 billion market capitaliazations. Apple should pay him good money to look at this stuff. Otherwise, its going to be only BadGuys.
- chalst 15y ago"Whether they listen to the reports or not is another matter." - It's kind of the point: the instinct of a bureaucracy that is not serious about security is just to keep things quiet in the belief that no noise means no problem. Schneier's excellent essay, "Full Disclosure of Security Vulnerabilities a 'Damned Good Idea'", observes that this reflex is in fact economically rational. http://www.schneier.com/essay-146.html http://www.schneier.com/essay-146.html