News for hackers. Stuff that matters.

A comment on Apple silently fixes iOS zero-day, asks bug reporter to keep quiet. Parent comment

Re:Apple silently fixes iOS zero-day, asks bug reporter to k... by genmud on Wednesday October 13, 2021 @07:17PM (#28858741)
I have also worked on managing bug bounties and that is why you keep lines of communication open with the researchers. Not to throw stones in glass houses, but there are a number of ways Apple could improve on their approach to how they do their bug bounty program.

I have heard of many researchers having extremely long delays, poor communication and simple things like not acknowledging the bug submissions.

[ Parent | on HN ]
Re:Apple silently fixes iOS zero-day, asks bug reporter to k... by weq on Wednesday October 13, 2021 @10:26PM (#28859896)
Aftering filing multiple bug reports with Apple now against WkWebView, I can say that extremely long delays and poor communication is not isolated to the bug bounty team :)
[ Parent | on HN ]
Re:Apple silently fixes iOS zero-day, asks bug reporter to k... by Thorrez on Thursday October 14, 2021 @01:36AM (#28860840)
Security bugs are much more important than other bugs. A security bug that's affecting no one currently could turn into a disaster tomorrow. A functionality bug that's affecting few people today will almost certainly affect few people tomorrow.
[ Parent | on HN ]