Re:Disclosure of three 0-day iOS vulnerabilities
by moonchrome on Friday September 24, 2021 @05:02AM
(#28640089)
I don't buy this. They fixed one reported, got back to him and acknowledge the lack of disclosure, apologised, promised to fix it and never actually disclosed it 3 reports later.
It's not a case of "someone missed this" it's "this seems dysfunctional".
Re:Disclosure of three 0-day iOS vulnerabilities
by ninth_ant on Friday September 24, 2021 @02:59AM
(#28639400)
I feel like Apple could afford to staff a security program like this. Much, much smaller and less wealthy companies manage it.
Re:Disclosure of three 0-day iOS vulnerabilities
by raylu on Friday September 24, 2021 @05:45PM
(#28648185)
much smaller, less wealthy companies attract far fewer reports
Re:Disclosure of three 0-day iOS vulnerabilities
by EMM_386 on Friday September 24, 2021 @07:40AM
(#28641060)
> Let’s say they have a team of 6 engineers tasked with this.
They are a trillion dollar company. They can have as many engineers as they'd like.
Re:Disclosure of three 0-day iOS vulnerabilities
by grey-area on Friday September 24, 2021 @09:23AM
(#28641984)
You'd probably be surprised how small some departments are at large companies, if they're seen as a cost centre rather than a profit centre.
I agree they could and should do a lot better, I'm just imagining the probable reasons for this level of dysfunction - the most likely explanation to me is an overwhelmed, overworked department submerged in so many requests that they can't filter out the useful ones or respond in a timely way.
Just as one other example of this, the bug reporting system at Apple is antiquated and seen as a black hole outside the company, probably again due to underinvestment.
Let’s say they have a team of 6 engineers tasked with this. They probably receive hundreds of reports a day, many bogus, some real, but all long winded descriptions like this framed to make the vuln seem as bad as possible. In addition many vuln reports are generated by automated tools and sprayed to thousands of sites/vendors daily in the hope of one of them paying out, they seem coherent at first glance but are often nonsense or not really a vuln at all, and of course there are many duplicates or near duplicates.
If each of these takes 20 mins to triage, 1 hour to properly look at and days to confirm, you can see how a team of any reasonable size would soon be completely submerged and unable to respond to anything but the most severe and succinct vulnerability reports in a timely way.