4 ms·

I don't understand why they don't just pay them to work on Asahi and then they can learn directly from all their findings?

stuaxo 3y ago
Apple would want them to sign an NDA and that would be incompatible with them doing as much as they do in Linux.
- microtonal 3y ago
  Apple can decide to not let them sign an NDA and just pay them for the excellent work that they are doing now and give them a good priority channel for reporting issues.
  - dmonitor 3y ago
    why would apple pay them to do something they already do for free?
    - danShumway 3y ago
      I very much doubt the math for the PR-to-cost ratio works out to justify hiring them, but presumably the reason would be so that Apple wouldn't have to see articles like this or to have the top comment on tech threads be "this is a huge embarrassment for Apple". Similar reason as to why companies have bug bounties; they want to incentivize hackers to report bugs through official channels early enough in development that they can get patched before release and before tech journalists write articles about them. They don't want to find out that their products have bugs via social media. Even if that process happens out in the open via a Github issue, getting giant problems like this caught before release and quickly escalated internally through official channels would go a long way towards mitigating article titles like this. Having said that, does Apple care about the Register or HN? Probably not? And assuming that Apple did care about bad PR among extreme power-users, would Asahi Linux want to be paid by Apple to do testing on their releases? That's also not necessarily a given, the team would have to decide if they wanted to have a more official relationship with the company or not.
      - fostware 3y ago
        Pretty sure TheReg has been on the Apple blacklist for PR and industry events for some time. Like TheReg, I think it'd be a badge of honor...
threeseed 3y ago
Because having worked at Apple and seen Radar. The issue has never been finding the bugs. It's having the capacity to fix the bugs. And when you are this early in the OS release cycle (we are only at 14.1) there are inevitably a lot of P1 issues that limited resources are competing to fix.
- Wowfunhappy 3y ago
  But I have to imagine an issue that renders Macs unbootable would have been considered blocking, had Apple known about it.
  - threeseed 3y ago
    It's an edge case with a workaround. P2 and definitely not enough to prevent a release. Only 14/16-inch models where users have explicitly disable ProMotion and are desperate to boot into the RecoveryOS.
    - Wowfunhappy 3y ago
      My understanding was that if you disable ProMotion you can become unable to boot into your main OS.
    - MichaelZuo 3y ago
      Like the other user said, this bug effects a much larger set of customers. To ship this severity of bug in an X.6 release too is definitely very eyebrow raising.
- callalex 3y ago
  Who/what is limiting those resources? It certainly isn’t a lack of US Dollars. Is it executives on the financial team requiring a never ending increase in profit margins even though the margins from two years ago were also infinitely sustaining?
  - SamuelAdams 3y ago
Twisell 3y ago
Asahi Lina (one team member) recently got a 6 figures paycheck from Apple through their bug bounty program for CVE-2022-32947 https://news.ycombinator.com/item?id=37543664 https://news.ycombinator.com/item?id=37543664 This is actually the best of both world, they stay independents, they get paid, Apple fixe the reported exploit.
- WaffleIronMaker 3y ago
  More information: Here's the clip where Asahi Lina says she received $150,000 for CVE-2022-32947: - https://youtu.be/hDek2cp0dmI?t=11451 https://youtu.be/hDek2cp0dmI?t=11451 And Apple credited them under GPU Drivers for macOS Ventura 13: - https://support.apple.com/en-us/HT213488#:~:text=CVE%2D2022%2D32947%3A%20Asahi%20Lina%20(%40LinaAsahi) https://support.apple.com/en-us/HT213488#:~:text=CVE%2D2022%... Related coverage: - https://secry.me/explore/news/cve-2022-32947-first-critical-security-vulnerability-discovered-by-a-vtuber-named-asahi-lina-in-macos/ https://secry.me/explore/news/cve-2022-32947-first-critical-... - https://nvd.nist.gov/vuln/detail/CVE-2022-32947 https://nvd.nist.gov/vuln/detail/CVE-2022-32947

stuaxo 3y ago

Apple would want them to sign an NDA and that would be incompatible with them doing as much as they do in Linux.

microtonal 3y ago
Apple can decide to not let them sign an NDA and just pay them for the excellent work that they are doing now and give them a good priority channel for reporting issues.
- dmonitor 3y ago
  why would apple pay them to do something they already do for free?
  - danShumway 3y ago
    I very much doubt the math for the PR-to-cost ratio works out to justify hiring them, but presumably the reason would be so that Apple wouldn't have to see articles like this or to have the top comment on tech threads be "this is a huge embarrassment for Apple". Similar reason as to why companies have bug bounties; they want to incentivize hackers to report bugs through official channels early enough in development that they can get patched before release and before tech journalists write articles about them. They don't want to find out that their products have bugs via social media. Even if that process happens out in the open via a Github issue, getting giant problems like this caught before release and quickly escalated internally through official channels would go a long way towards mitigating article titles like this. Having said that, does Apple care about the Register or HN? Probably not? And assuming that Apple did care about bad PR among extreme power-users, would Asahi Linux want to be paid by Apple to do testing on their releases? That's also not necessarily a given, the team would have to decide if they wanted to have a more official relationship with the company or not.
    - fostware 3y ago
      Pretty sure TheReg has been on the Apple blacklist for PR and industry events for some time. Like TheReg, I think it'd be a badge of honor...

threeseed 3y ago

Because having worked at Apple and seen Radar. The issue has never been finding the bugs. It's having the capacity to fix the bugs. And when you are this early in the OS release cycle (we are only at 14.1) there are inevitably a lot of P1 issues that limited resources are competing to fix.

Wowfunhappy 3y ago
But I have to imagine an issue that renders Macs unbootable would have been considered blocking, had Apple known about it.
- threeseed 3y ago
  It's an edge case with a workaround. P2 and definitely not enough to prevent a release. Only 14/16-inch models where users have explicitly disable ProMotion and are desperate to boot into the RecoveryOS.
  - Wowfunhappy 3y ago
    My understanding was that if you disable ProMotion you can become unable to boot into your main OS.
  - MichaelZuo 3y ago
    Like the other user said, this bug effects a much larger set of customers. To ship this severity of bug in an X.6 release too is definitely very eyebrow raising.
callalex 3y ago
Who/what is limiting those resources? It certainly isn’t a lack of US Dollars. Is it executives on the financial team requiring a never ending increase in profit margins even though the margins from two years ago were also infinitely sustaining?
- SamuelAdams 3y ago

Twisell 3y ago

Asahi Lina (one team member) recently got a 6 figures paycheck from Apple through their bug bounty program for CVE-2022-32947 https://news.ycombinator.com/item?id=37543664 https://news.ycombinator.com/item?id=37543664 This is actually the best of both world, they stay independents, they get paid, Apple fixe the reported exploit.

WaffleIronMaker 3y ago
More information: Here's the clip where Asahi Lina says she received $150,000 for CVE-2022-32947: - https://youtu.be/hDek2cp0dmI?t=11451 https://youtu.be/hDek2cp0dmI?t=11451 And Apple credited them under GPU Drivers for macOS Ventura 13: - https://support.apple.com/en-us/HT213488#:~:text=CVE%2D2022%2D32947%3A%20Asahi%20Lina%20(%40LinaAsahi) https://support.apple.com/en-us/HT213488#:~:text=CVE%2D2022%... Related coverage: - https://secry.me/explore/news/cve-2022-32947-first-critical-security-vulnerability-discovered-by-a-vtuber-named-asahi-lina-in-macos/ https://secry.me/explore/news/cve-2022-32947-first-critical-... - https://nvd.nist.gov/vuln/detail/CVE-2022-32947 https://nvd.nist.gov/vuln/detail/CVE-2022-32947