3 ms·

"Why? This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed i

by Y-bar 12y ago

"Why? This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it." I'm not a security expert but that does not sound like responsible disclosure to me. Granted, Apple is not easy to communicate with, but still… Edit: This does indeed look like a really bad thing. At the very least one would hope that login attempts were rate limited.

dogma1138 12y ago
Having had to deal with apple and knowing quite a few other people who had a simmilar exprience i have a feeling that this was the only way of doing so. Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue. This for some reason is much more prevelant for their services and mobile platform (especially when it comes to "design" flaws rather than a simple software bug) than the OSX team which while might simply not reply unless it gets enough traction on the the mailing list will atleast not send you threatening letters from their lawyers.
- Y-bar 12y ago
  > at worst ciminilizing people who do try and report an issue […] will atleast not send you threatening letters from their lawyers Wow. Citation needed, please.
  - Y-bar 12y ago
    So, I've been googling but can't find any single instance where Apple seems to have threatened a security researcher. I'm new here on HN, but I don't understand why I was down voted. Was it seen as passive-agressive to ask, I could understand that, but any actual source would be appreciated. We all know that anything that paints Apple in a bad light travels faster than the speed of said light and generally gets picked up by a dozen news outlets, no matter how rumour-esque it is. So it ought to be some traces of Apple taking legal actions against people reporting security issues against them, no?
    - josephlord 12y ago
      In general "citation needed" on its own is frowned on as it is lazy and negative adding little to the discussion. My guess is that this is the reason for downvotes. Some claims do have to be called out and this might have be one of them. An indication that it doesn't match your experience and that you have done at least a cursory search before requesting the citation would be less likely to be downvoted.
- matthewmacleod 12y ago
  Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue. I don't think this is accurate, is it? I'm not aware of any security issue where Apple has tried to criminalise the reporter. I'm not even aware of an issue that hasn't been 'accepted'.
- ceejayoz 12y ago
  I'm guessing you're mixing up Apple with AT&T. http://arstechnica.com/tech-policy/2013/07/internet-troll-weev-appeals-41-month-sentence-for-attipad-hack/ http://arstechnica.com/tech-policy/2013/07/internet-troll-we...
- dsacco 12y ago
  I've never once had difficulty reporting a security vulnerability to Apple. For that matter, I've never seen any of my friends in /r/netsec have difficulty either. Slow to respond? Perhaps, if they receive many reports. Outright ignore or invalidate real flaws? Never seen it. Do you have a data point to back this up?

by Y-bar 12y ago

dogma1138 12y ago

Having had to deal with apple and knowing quite a few other people who had a simmilar exprience i have a feeling that this was the only way of doing so. Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue. This for some reason is much more prevelant for their services and mobile platform (especially when it comes to "design" flaws rather than a simple software bug) than the OSX team which while might simply not reply unless it gets enough traction on the the mailing list will atleast not send you threatening letters from their lawyers.

Y-bar 12y ago
> at worst ciminilizing people who do try and report an issue […] will atleast not send you threatening letters from their lawyers Wow. Citation needed, please.
- Y-bar 12y ago
  So, I've been googling but can't find any single instance where Apple seems to have threatened a security researcher. I'm new here on HN, but I don't understand why I was down voted. Was it seen as passive-agressive to ask, I could understand that, but any actual source would be appreciated. We all know that anything that paints Apple in a bad light travels faster than the speed of said light and generally gets picked up by a dozen news outlets, no matter how rumour-esque it is. So it ought to be some traces of Apple taking legal actions against people reporting security issues against them, no?
  - josephlord 12y ago
    In general "citation needed" on its own is frowned on as it is lazy and negative adding little to the discussion. My guess is that this is the reason for downvotes. Some claims do have to be called out and this might have be one of them. An indication that it doesn't match your experience and that you have done at least a cursory search before requesting the citation would be less likely to be downvoted.
matthewmacleod 12y ago
Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue. I don't think this is accurate, is it? I'm not aware of any security issue where Apple has tried to criminalise the reporter. I'm not even aware of an issue that hasn't been 'accepted'.
ceejayoz 12y ago
I'm guessing you're mixing up Apple with AT&T. http://arstechnica.com/tech-policy/2013/07/internet-troll-weev-appeals-41-month-sentence-for-attipad-hack/ http://arstechnica.com/tech-policy/2013/07/internet-troll-we...
dsacco 12y ago
I've never once had difficulty reporting a security vulnerability to Apple. For that matter, I've never seen any of my friends in /r/netsec have difficulty either. Slow to respond? Perhaps, if they receive many reports. Outright ignore or invalidate real flaws? Never seen it. Do you have a data point to back this up?