4 ms·

I understand not reporting it to Apple, in their case they have basically disclosed the issue to anybody that read the manual (and they don't have the bug in th

I understand not reporting it to Apple, in their case they have basically disclosed the issue to anybody that read the manual (and they don't have the bug in their apps). I was primarily referring to the major players who do have the bug and whose primary responsibility the bug is.

algorithm_dk 12y ago
I can't do responsible disclosure when there are tens of thousands of apps using webView. The number of vulnerable apps is way too high for any kind of responsible disclosure.
- eyeareque 12y ago
  You could have told Apple. They could fix this in iOS, blocking the apps via a software update. If it was me, I would have notified Apple and all of the companies who have bug bounty programs.
  - deleted 12y ago
    [deleted]
  - gepeto42 12y ago
    Apple knows. Look at the security content of iOS 7.1. http://support.apple.com/kb/HT6162 http://support.apple.com/kb/HT6162 I reported CVE-2013-6835. They fixed Facetime-Audio from Safari, but not from other browsers (yet?). This is quite a wide issue. I do not think letting every individual developer know is feasible. I did it for a few bad issues, but there's a limit to what can be done. And a lot of these can be found in a matter of minutes anyways.
    - eyeareque 12y ago
      It might not be feasible, but why not if they might pay you money for it?
deleted 12y ago
[deleted]