Hacker News Reader

Comment by giobox | Hacker News Reader

Responsible Disclosure is widely regarded as a good practice in these situations. Blame isn't the key issue - fixing the problem quickly and safely is. Widespread disclosure before Apple have even a chance to respond in a timely fashion is inherently unsafe.

You would hope the self-described twitter bio "Agile Software Craftsman" might have thought about this a little before tweeting.

> https://en.wikipedia.org/wiki/Responsible_disclosure

View on HN

The poster practiced Full Disclosure, which is also a valid disclosure policy.

Since we're just making up statements, I guarantee that Apple would never voluntarily disclose this issue if it was reported privately. So Full Disclosure is the only way to put Apple's feet to the fire, as it's the only way in which this issue would have had any visibility whatsoever.

https://en.wikipedia.org/wiki/Full_disclosure_(computer_secu...

On what basis do you "guarantee" this?

It's used as an idiom, meaning roughly "I have total confidence".

> On what basis do you "guarantee" this?

I think on the (probably intentionally snarky) basis of "just making up statements":

> Since we're just making up statements, I guarantee that Apple would never voluntarily disclose this issue if it was reported privately.

Private Disclosure does not prevent you from publicly disclosing it after a grace period.

What grace period is appropriate for a 0 day root login vulnerability?

This guy is, with all probability, not the first one to have found it.

If there was a vulnerability that allowed anyone to open your car and drive off with it, you wouldn't care if he was the first to find it or not. You'd only care about it getting fixed before anyone else knows about it.

I'm not sure what length grace period is appropriate, though.

If there was a vulnerability that allowed anyone to open my car, I'd want to known ASAP, because I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

Same applies for Apple. No reason to believe this guy was the first one to find this exploit, we only know he was the first one to publicize it.

> I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

True, and this is where the analogy breaks down, since they would not be able to remotely send over a fix. But Apple would, and apparently now has.

To be pedantic, this isn't a 0day root login vuln, but a priv escalation vuln.

"Responsible Disclosure" is a term rejected by the industry as a loaded phrase that favors vendors, instead preferring the term Coordinated Disclosure. Even so, reasonable professionals still disagree that this is the best option, in a debate that has existed for decades, so it's by no means settled as the "proper" way.

Do you have any good history on this you can link to? Sounds very interesting.

Reply on news.ycombinator.com