4 ms·

“Moreover, while sending crafted packets and attempting all sorts of things, I’ve discovered several vulnerabilities in the Apple custom made parsers. I will no

“Moreover, while sending crafted packets and attempting all sorts of things, I’ve discovered several vulnerabilities in the Apple custom made parsers. I will not discuss them here (exception made for the session spoofing) but at the same time I’m not interested in reporting them to Apple…” Erm, hope they’re not super serious I guess?

ithkuil 3y ago
Taken out of context it looks a bit weird, but it does explain the motivation: "I’ve heard way too many negative stories about their disclosure program and in general how they mistreat researchers."
- Avamander 3y ago
  Yeah. Plenty of such stories, I had to reproduce a security issue across four macOS versions before it was finally fixed. Such a waste of time.
isodev 3y ago
[flagged]
- iforgotpassword 3y ago
  So the question is whether those bugs are in the framework part provided by Apple, or the application specific code handing the individual messages.
- madeofpalk 3y ago
  It's two lines in an otherwise pretty indepth technical article. Hardly a tantrum.
  - Gorbzel 3y ago
    What he’s basically saying here is “I’d rather let my personal opinion prevail than responsibly disclose and get some vulnerabilities fixed.” Even if, at their worst, Apple is as petty as he’s “heard” (given the FUD surrounding quite a lot of engineer’s), the proper response is responding with less pettiness, not more. It’s reflective of the author’s character no matter how he expressed the tantrum.
    - valianteffort 3y ago
      Reporting a vulnerability should be extremely low effort. Regardless of how I feel about a company I wouldn't want users to get screwed. I tried to disclose to google once and they required an account so instead I moved on with my life. I don't care about random people enough to make a google account.
    - RoseRose 3y ago
      Well this is absolute bullshit. You're discussing private software. It's up to the owner to offer a bug program that's enticing enough to debug their own software if they care.
- refulgentis 3y ago
  I don't understand, you have a high-level technical understanding of MPC, but you're dismissive of the criticism? An auth strategy based on a Map<String, bool>, where String is a plain-text beacon on the LAN, seems well-worth criticizing. I may have gotten turned about when trying to understand a few things, my understanding is you dismiss this because you're not sure if one feature uses it? And because parsers can't have vulnerabilities on arbitrary data?

ithkuil 3y ago

Taken out of context it looks a bit weird, but it does explain the motivation: "I’ve heard way too many negative stories about their disclosure program and in general how they mistreat researchers."

Avamander 3y ago
Yeah. Plenty of such stories, I had to reproduce a security issue across four macOS versions before it was finally fixed. Such a waste of time.

isodev 3y ago

[flagged]

iforgotpassword 3y ago
So the question is whether those bugs are in the framework part provided by Apple, or the application specific code handing the individual messages.
madeofpalk 3y ago
It's two lines in an otherwise pretty indepth technical article. Hardly a tantrum.
- Gorbzel 3y ago
  What he’s basically saying here is “I’d rather let my personal opinion prevail than responsibly disclose and get some vulnerabilities fixed.” Even if, at their worst, Apple is as petty as he’s “heard” (given the FUD surrounding quite a lot of engineer’s), the proper response is responding with less pettiness, not more. It’s reflective of the author’s character no matter how he expressed the tantrum.
  - valianteffort 3y ago
    Reporting a vulnerability should be extremely low effort. Regardless of how I feel about a company I wouldn't want users to get screwed. I tried to disclose to google once and they required an account so instead I moved on with my life. I don't care about random people enough to make a google account.
  - RoseRose 3y ago
    Well this is absolute bullshit. You're discussing private software. It's up to the owner to offer a bug program that's enticing enough to debug their own software if they care.
refulgentis 3y ago
I don't understand, you have a high-level technical understanding of MPC, but you're dismissive of the criticism? An auth strategy based on a Map<String, bool>, where String is a plain-text beacon on the LAN, seems well-worth criticizing. I may have gotten turned about when trying to understand a few things, my understanding is you dismiss this because you're not sure if one feature uses it? And because parsers can't have vulnerabilities on arbitrary data?