4 ms·
How is it ethical to distribute this without first disclosing to apple and waiting for a fix at least a few days?
by delackner 12y ago
How is it ethical to distribute this without first disclosing to apple and waiting for a fix at least a few days?
- orian 12y ago"The end of fun, Apple have just patched"
- mark2456 12y agoEasy answer: It is not.
- camillomiller 12y agoIt is not and it probably had consequences (celebrity nude pics leak).
- tomjen3 12y agoSimple: it is Apples problem if their servers aren't secure. You don't owe apple free work. Delayed disclosure is a nicety, not something you are obligated to do.
- shapov 12y agoSo there is no ethical responsibility to protect the users who will be left vulnerable to this exploit? Remember the danger here is screwing people who have iCloud accounts. It's not like Julie the housewife in Minnesota, had any say in the security of Apple's products.
- MichaelGG 12y agoMaybe the harm caused to a few people is worth the publicity and increased awareness.
- Drakim 12y agoOne problem is that if the exploit is given silently to the company, they often don't change any of their practices (even if they fix that particular exploit), and more exploits soon surface, and maybe this time by people who plan to abuse them instead of telling the company. By going loud and public, you ensure that the company has to do something to save face. It can't just be forgotten on some manager's desk. And the fact is, you, as part of the public, would only know about the times when somebody goes loud about an exploit. For all you know, there might have been hundreds upon hundreds of times when security researches have gone to the company and been outright ignored, and when one finally goes loud with what he has found, you say "He really should have done this more quietly, it would have been much more responsible"
- wklauss 12y agoEthics are a nicety, not an obligation.
- Quarrelsome 12y agoNot very. We don't know if they contacted Apple. However from my knowledge Apple doesn't offer bug bounty or often respond to security notifications.