4 ms·

If you become aware that your system is compromised, and you don't yet know the extent of how compromised it is, and that system contains highly sensitive data,

If you become aware that your system is compromised, and you don't yet know the extent of how compromised it is, and that system contains highly sensitive data, why would you do anything other than take it down until you have fully restored your confidence in the system? What difference does it make if the disclosure was responsible or not? If Facebook's billing platform for advertisers was compromised in some fashion, do you think they'd wait even a minute to take it off-line until they situation was under control?

smackfu 13y ago
>What difference does it make if the disclosure was responsible or not? If someone gives you reproduce steps for an issue, that's a lot better than just seeing intrusions or weird stuff happening without any idea of the cause.
- numbsafari 13y ago
  So if someone gives you steps to reproduce you leave the system on-line?
  - smackfu 13y ago
    Sorry if I was unclear. It's not taking the system down that I am surprised at... it's keeping it down for weeks. How many people have software jobs that would accept a sev 1 outage for that long? I know we would get escalated to the CEO. But I guess that's the benefit for Apple... they don't have to care about their developer customers. And steps to reproduce should help you bring the system up faster.
    - interpol_p 13y ago
      > But I guess that's the benefit for Apple... they don't have to care about their developer customers. I'm not sure I understand your argument. You seem to be implying that they kept their dev center down for longer than they could have? I don't think we have any idea how hard they worked to get it back online — maybe they put in as much effort as they could to resolve the issue as quickly as possible, and "as quickly as possible" turned out to be weeks. They did restore the most useful dev tools after one week (adding devices, updating provisioning profiles). So it's not like they kept the entire system down for weeks. And surely rebuilding their system now is better for their developer customers in the long term? If they had simply attempted to patch it up, it may have led to other exploits down the road. Rebuilding it from scratch seemed like a painful but necessary long-term procedure.

smackfu 13y ago

>What difference does it make if the disclosure was responsible or not? If someone gives you reproduce steps for an issue, that's a lot better than just seeing intrusions or weird stuff happening without any idea of the cause.

numbsafari 13y ago
So if someone gives you steps to reproduce you leave the system on-line?
- smackfu 13y ago
  Sorry if I was unclear. It's not taking the system down that I am surprised at... it's keeping it down for weeks. How many people have software jobs that would accept a sev 1 outage for that long? I know we would get escalated to the CEO. But I guess that's the benefit for Apple... they don't have to care about their developer customers. And steps to reproduce should help you bring the system up faster.
  - interpol_p 13y ago
    > But I guess that's the benefit for Apple... they don't have to care about their developer customers. I'm not sure I understand your argument. You seem to be implying that they kept their dev center down for longer than they could have? I don't think we have any idea how hard they worked to get it back online — maybe they put in as much effort as they could to resolve the issue as quickly as possible, and "as quickly as possible" turned out to be weeks. They did restore the most useful dev tools after one week (adding devices, updating provisioning profiles). So it's not like they kept the entire system down for weeks. And surely rebuilding their system now is better for their developer customers in the long term? If they had simply attempted to patch it up, it may have led to other exploits down the road. Rebuilding it from scratch seemed like a painful but necessary long-term procedure.