Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I agree this is theater; no serious whitehat researcher would sign a deal forcing them to accept dates from the manufacturer. It won't be useful for its intended purpose.

On the bright side, it will be very useful for jailbreak research and in a way, those bugs _do_ get disclosed to Apple for them to subsequently fix. Not necessarily the way Apple wants, but it does shine daylight on their code.

These guys keep working exploits close to their hearts and don't release them specifically so they can get a look at new hardware. That will no longer be necessary. You find an exploit, you can release it right away.

And on the gripping hand, it will also be used by malicious criminals and state actors to develop zero days for various evil purposes.



> On the bright side, it will be very useful for jailbreak research and in a way, those bugs _do_ get disclosed to Apple for them to subsequently fix.

It’s useless for jailbreak research because Apple will force you to shut up about it at least until they patch it, so now you can’t jailbreak.


That is if people obey the NDA of course. I'm sure not everyone will do so.

However finding a bug, reporting it and then 'suddenly' a jailbreak appearing that would use it, would be highly suspicious indeed. So they'd probably have to give up the chance of getting the bug bounty.

PS: I'm certainly not signing that NDA myself :)


Yes. Once these devices exist they will be used by everybody interested in that sort of access. Ironically, pretty much everybody other than whitehats.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: