undefined | Better HN

0 pointsbangonkeyboard8y ago0 comments

If you urgently want Apple to fix something, you do not file quiet bug reports. Apple only responds reliably to PR storms.

This vulnerability is ridiculous, unacceptable, and braindead to execute.

0 comments

patcheudor8y ago

> Apple only responds reliably to PR storms

They've been quick (within 45 days) to patch every major bug I've reported to them and where the bugs were cross platform, impacting Windows, Android, etc., they've consistently been amongst the quickest to issue a patch so I'm not sure how you qualify that statement.

bangonkeyboardOP8y ago

I qualified it with "reliably". Major bugs reported by you, a security researcher, may be bucketed differently than those deemed less serious or filed by others. As a recent example, a minor bug like the iOS 11 calculator ignoring keypresses had reports filed since Beta 1, but only after it made headlines and caused Apple public embarrassment will it be addressed in the upcoming 11.2, six months later.

briandear8y ago

A calculator bug is hardly in the same ballpark.

MikusR8y ago

It's worse. It shows nobody at Apple even tried to use app they are shipping.

tytso8y ago

Sorry. 45 days is not quick.

saagarjha8y ago

You can go about it both ways: file a bug report, put a reasonable date that you want them to fix it by. Then you can disclose it.

patcheudor8y ago

This happens quite often. Report a bug to Apple through CERT as an example and they run with a well known 45 day disclosure timeline. For researchers who don't want to get into vendor conflicts this is a good path because CERT ultimately holds the decision.

Scoundreller8y ago

We need to come up with a witty name to get it fixed faster.

maephisto8y ago

iRoot. uRoot. Everybody Root.

plttn8y ago

My current favorite is I am Root.

Rexxar8y ago

iAmroot to respect the brand policy.

bhhaskin8y ago

AppleGate

neverartful8y ago

i0wned