Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

macOS Keychain Security Flaw Discovered by Researcher, but Details Not Shared With Apple Over Bug Bounty Protest

manu chao said:
And I asked whether you would be for it:
"Assuming for a second the forgone income would not be compensated for by more satisfied customers buying more Apple products."
Click to expand...

If it wasn't going to make customers happier, leading to more money, then I don't know. But we are at the point where the goal is getting more money from each customer for the long run. And sometimes that means doing things to make the Apple ecosystem more sticky.

I find most Apple stockholders to be incredibly short sighted, though.
 
Michael Goff said:
Wow, are you for real?
Click to expand...
Yes...name a company better at executing their initiatives.

You people are amazing. It doesn’t mean Apple does no wrong, but as a for profit business, Apple is the envy of all.
[doublepost=1549732454][/doublepost]
Michael Goff said:
If it wasn't going to make customers happier, leading to more money, then I don't know. But we are at the point where the goal is getting more money from each customer for the long run. And sometimes that means doing things to make the Apple ecosystem more sticky.

I find most Apple stockholders to be incredibly short sighted, though.
Click to expand...
We are far longer sighted. The people that haven’t owned the stock for a decade are the ones clamoring for Tim Cook to be gone or laughing because the stock doesn’t trade at a new high every day. Shareholders have to think rationally because we actually have real money invested.

Contrary to many, I actually have to know the story, the numbers, the competition, how satisfied are customers, and cut through the noise. If I don’t, I lose money.
 
Michael Goff said:
I wasn't the one who initially used the term too much money. Sure would be nice if you read before jumping in.
Click to expand...
Now who's being pedantic? It doesn't matter if you're the first one using the term. You're vilifying Apple as a "faceless corporation" who "hoards cash" and criticizing their pricing, claiming they're "bending people over", as if they're forcing people to spend money. They could charge $40,000 for an iPhone 4, or $4,000 per month for 1GB of iCloud storage, and it would still be up to consumers to decide if those products and services are worth the price being asked. It's obvious that Apple's prices are acceptable to billions of people, because they keep buying their products, enough to give Apple hundreds of billions in profits. Apple doesn't need to apologize for being more successful than other companies. I buy Apple products because they meet my needs better than competitive products, at prices that I consider to be reasonable. When they stop doing that, I'll buy from someone else.
 
Baymowe335 said:
Yes...name a company better at executing their initiatives.

You people are amazing. It doesn’t mean Apple does no wrong, but as a for profit business, Apple is the envy of all.
[doublepost=1549732454][/doublepost]
We are far longer sighted. The people that haven’t owned the stock for a decade are the ones clamoring for Tim Cook to be gone or laughing because the stock doesn’t trade at a new high every day. Shareholders have to think rationally because we actually have real money invested.

Contrary to many, I actually have to know the story, the numbers, the competition, how satisfied are customers, and cut through the noise. If I don’t, I lose money.
Click to expand...

I'm more surprised at your whole "appeal to authority" schtick.
 
displaced said:
Hmm....
Should a researcher withhold details on a discovered bug as a protest about the lack of a bounty? I don't think so. It seems both unprofessional and dangerous.
Click to expand...

Seems like it is apple acting unprofessionaly and dangerously. When most tech companies have bug bounties and apple doesn't have one for mac os, that seems unprofessional. Like apple is some small operation that can't afford it.

If apple was a bank, they would have zero security guards. Costs too much.
 
  • Like
Reactions: m00min
Michael Goff said:
I'm more surprised at your whole "appeal to authority" schtick.
Click to expand...
Apple is the best at making money, so why wouldn't they be the authority on it?

I don't need any other evidence. Apple has done it year after year and until that changes, they are the best at it. So you questioning their Mac strategy is probably incorrect. They have more data than you AND are winning, so why would you be right?

You're conflating wanting something with it being good business. You assume the unknown (to you) number of people they are upsetting is somehow a negative to their business.

Never forget this is a business. Apple was burned in China because they screwed up and it showed quite clearly in the numbers. Mac, no.
 
Baymowe335 said:
Apple is the best at making money, so why wouldn't they be the authority on it?

I don't need any other evidence. Apple has done it year after year and until that changes, they are the best at it. So you questioning their Mac strategy is probably incorrect. They have more data than you AND are winning, so why would you be right?

You're conflating wanting something with it being good business. You assume the unknown (to you) number of people they are upsetting is somehow a negative to their business.

Never forget this is a business. Apple was burned in China because they screwed up and it showed quite clearly in the numbers. Mac, no.
Click to expand...

Okay. It's obvious to me that Apple could tell you the sky was purple and you wouldn't bother questioning anything.
 
Michael Goff said:
Okay. It's obvious to me that Apple could tell you the sky was purple and you wouldn't bother questioning anything.
Click to expand...
I question things that need questioning, like China in their most recent quarter.

The Mac is a smaller (for Apple) business that is doing quite well, posting 9% growth. A new Mac every year or features you think are important won’t always translate to data.

All I’m saying is Apple has all the data they need to validate the strategy and the data I have shows it’s working on some level.

It always could be better, but you guys act like you know how to manage Apple and Apple doesn’t.
 
displaced said:
Do I work for free? No. But then I don't spend days, weeks or months working on a company's product when they have no idea I exist.

The researcher knew Apple did not offer a bounty, but invested the time anyway.

Now... having said that...

I think Apple should offer a bug bounty. It's a great way to attract the attention of these skilled researchers. But the security community surely has better ways of engaging with Apple than withholding information about a potentially critical bug. Since they offer one for iOS, Apple are clearly not against the principle.

If the bug has been found, it should be disclosed so that it can be fixed in order to protect millions of macOS users -- that's the right thing to do. Rewarding researchers for finding bugs is also the right thing to do.
Click to expand...

If that's the case, then Apple has no incentive to provide a bounty program whether he reports it or not. He might as well kept quiet and let the nefarious hackers find the bug.
[doublepost=1549782990][/doublepost]
lederermc said:
The user must be logged so a stolen Mac would not be vulnerable unless it was stolen while unlocked. This isn't really all that "Nasty"... just sloppy/bad.
Click to expand...
A bug like this is not necessarily nasty. It becomes nasty when a bug in Safari allows remote code execution which then exploit the Keychain bug.
[doublepost=1549783281][/doublepost]
JGRE said:
No, I am staying that someone would need physical access to a Mac, would need to have the user password en manage to install a malicious app in order to get access to the keychain information, without the owner having a clue.

To me this is the same as saying, I allow me access to your house, I gave me the key and pointed out were I hide my sensitive information.

That is not a bug, but me being stupid.
Click to expand...
You don't need physical access if you can exploit a remote execution bug in Safari which can then deploy the Keychain bug. The browsers Safari, Chrome, Edge, Firefox, etc... are full of bugs and many of them are critical RCE.
[doublepost=1549783794][/doublepost]
alexhardaker said:
Maybe because it would be the right thing to do?
Click to expand...

Geez kinda like the "right thing to do" was to deny^100 until irrefutable data is provided.

Antennagate
Bendgate
Touch Disease
Batterygate (secret throttling)

Did I miss anything else?
[doublepost=1549784734][/doublepost]
nihil0 said:
Nobody asked him to perform the security test. He did this in his free time. Why the hell should he now blackmail Apple? Also, if he considers himself "good" hacker or "ethical" hacker, he disqualified himself by asking for any kind of money with this. If he wants to be paid by Apple, then he should submit CV and become their employee.
Click to expand...
He's asking Apple to have a bounty program for MacOS like Google (Chrome OS and Android) and Microsoft (Windows). It's a far better approach for Apple than hiring a person permanently full-time. No need to pay them $150,000+ every year.
[doublepost=1549786329][/doublepost]
Heineken said:
Apple has chosen not to offer any bug bounty programs for OS X at this point. Nobody knows the reasoning behind that decision. Again it doesn’t mean that some guy can come and play basically entitled victim for something he wasn’t asked to do. End of story.
Click to expand...

It's not that difficult to take a guess. A proper bounty program offer security researchers huge incentives to find defects. No bounty program = no incentives = "no" bugs = macOS is pretty safe, right? It's rather ironic that Apple is all about security "We designed macOS with advanced technologies that work together to constantly monitor, encrypt, update — and ultimately keep your Mac safer." and yet they have no incentives for responsible disclosures.

Guy: You have a bug in Keychain.
Apple: Sure let's have it. Thx for your time.
Guy: You should offer a bounty program.
Apple: No
Guy: Okay, you can have your employees find it.
Apple: Sure
Guy: Fine

Apple has no obligation to offer a bounty program, but Apple is hypocritical to its customers on security. It's hard to believe that Apple being the wealthiest company in the world, doesn't have a bounty program for macOS that provide fair incentives to the responsible hackers.
 
Michael Goff said:
You got me. Since he isn't starving, he should do work for free.
Click to expand...
Is he starving? We don’t know that. Do you really think that the Apple bug he found is the only one he’s found? He’ll do the same for other companies and their OSs. They have a bounty program. Use those. He should tell Apple about it. It was his choice to sit there and find a bug in macOS, knowing Apple don’t offer a program. Do the right thing and tell them about it. No none wants their data etc being at risk. Ask them to start a bounty program. Simple
 
alexhardaker said:
Is he starving? We don’t know that. Do you really think that the Apple bug he found is the only one he’s found? He’ll do the same for other companies and their OSs. They have a bounty program. Use those. He should tell Apple about it. It was his choice to sit there and find a bug in macOS, knowing Apple don’t offer a program. Do the right thing and tell them about it. No none wants their data etc being at risk. Ask them to start a bounty program. Simple
Click to expand...

Yes. Ask them nicely. That's how billion dollar corporations work, you asking nicely. Are you being serious?
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back