Hacker News new | ask | show | jobs
by CGamesPlay 2692 days ago
[deleted]
4 comments

Why do you expect some random member of the public to obey an arbitrary rule from the infosec community that they don't even all agree on?
Oh I don't. I expect Apple to hold their bug reporters to those standards, though, so it's interesting to see that they are giving a "bounty" to this "irresponsible disclosure".
How was the disclosure irresponsible? AIUI, multiple attempts were made to report the bug. It went viral a couple of days later on social media. I'm not aware of a link between those two events.
Huh? Group calls were not a new feature, and the teen's mother made several attempts to disclose it privately to Apple, including registering for a developer account and submitting a bug from there. I'm pretty sure that's as close as "responsible disclosure" as you can get.
> Group calls were not a new feature

This bug affected Group FaceTime, which was added in 12.1 (released in October)

> the guy didn’t report it responsibly

What? As far as I understand, with his mom, he attempted to report it to the product-security email Apple tells you to do, they were brushed off and told to file radars, which they then did. And nothing happened. So, yes, he reported it responsibly and was ignored... traditionally, that's when security researchers say you move to reporting it via more public means...

Do you know how difficult it is to get into a bounty program?