Hacker News Reader

They would. But if there was a software vulnerability that would wipe out the hard drives of computers still realistically in use, much past that 3 year agreement expiry? i'd expect them to be on that.

View on HN

Suppose there were a vulnerability in Mac OS X Tiger that wiped the hard drive of any G4 Powerbook connected to the internet. Would you expect Apple to be on that?

Actually yes, in that scenario

There are almost 2800 CVEs listed for Mac OS. Do you really believe that none of those are remotely exploitable on some old version of Max OS?

The company is among the most responsive to security issues because security is directly tied to their core value around data privacy.

From conversations on this website about Apple's responsiveness/attitude to security researchers hunting bounties, I have gotten a contrary impression about Apple.

They are not perfect and not always as responsive as I’d like.

They issue security updates for their current OS and 2 versions before, AFAIK.

Is this your experience with Apple as a user or as a security researcher?

As a user interesting in security and following the field quite closely. I know about the limitations of their bug bounty program and some bad experiences some people have had with it. They still ship security updates to 8 years old devices and 3 years old OSes. Is that a problem?

Reply on news.ycombinator.com