Hacker News Reader

Comment by algorithm_dk | Hacker News Reader

It is not a 0day in the traditional meaning, it's a simple <did not read the manual> and <bad defaults> case. On the other hand I've been waiting to get on Apple's HoF for two years now, reporting cross-site scripting bugs and even a sqli - yet I'm not there. Apple is not getting any responsible disclosure from me.

View on HN

So are you investigating security to find security holes or to be on the hall of fame of cool kids?

This affects users much more than it affects Apple.

Then go and tell Apple.

I understand not reporting it to Apple, in their case they have basically disclosed the issue to anybody that read the manual (and they don't have the bug in their apps). I was primarily referring to the major players who do have the bug and whose primary responsibility the bug is.

I can't do responsible disclosure when there are tens of thousands of apps using webView. The number of vulnerable apps is way too high for any kind of responsible disclosure.

You could have told Apple. They could fix this in iOS, blocking the apps via a software update.

If it was me, I would have notified Apple and all of the companies who have bug bounty programs.

Apple knows. Look at the security content of iOS 7.1.

http://support.apple.com/kb/HT6162

I reported CVE-2013-6835. They fixed Facetime-Audio from Safari, but not from other browsers (yet?). This is quite a wide issue. I do not think letting every individual developer know is feasible. I did it for a few bad issues, but there's a limit to what can be done.

And a lot of these can be found in a matter of minutes anyways.

It might not be feasible, but why not if they might pay you money for it?

Reply on news.ycombinator.com