Published 18 years 10 months ago • Last updated March 22, 2025 • ⏱️ 2 min read
Apple annoy me or rather their security attitude annoys me. I told them about a vulnerability months ago, I persisted and told them again. I got a generic reply from them saying:-
Hello,
Thank you for filing this issue via Apple's bug reporting system. Apple takes every report of a potential security problem very seriously.
After examining your report we do not believe that this issue is a security exposure.
When filing a bug report, other Classification values are available to describe the type of issue: "Performance", "Crash or Data Loss", "Serious Bug", "Other Bug/Has Workaround", "Feature (New)", and "Enhancement". For the request you filed, we will change the classification from "Security" to the appropriate one to assist the engineering teams in handling it.
If you have any questions or concerns please feel free to let us know.
Thank you,
Apple Product Security team [www.apple.com] PGP Key ID: 0xB8469E6D Fingerprint: FD20 40DB F7BC 37B9 6E78 4C3B C800 A2AB B846 9E6D
Then after posting it to sla.ckers I actually talked to someone at Apple, you can view the thread here:- sla.ckers thread
I was annoyed, Apple clearly don't understand security I knew when I discovered the flaw it was a major one because local zones shouldn't be able to access external domains it's bloody obvious. Then I get this guy from Apple telling me that it isn't serious, well mate you have to remember attacks get better not worse and now the same flaw can access domains from anywhere. Serious? Damn right it's serious! It's a good job I'm a good guy because bad guys wouldn't be telling anyone that's for sure and when it came out of beta then boom! All your domains belong to the bad guys.
Screen shot on windows:- [Blocked Image]
Screen shot on OS X:- [Blocked Image]