Apple AirTag Bug Enables ‘Good Samaritan’ Attack
This multi-billion dollar company is somehow managing to mismanage responsible disclosure and their bug bounty program in such a way that it's actually detrimental to them. It's astonishing.<p>It's <i>so easy</i> to get soft wins running a program like this. Communicate with the reporter, make sure you have enough of a mandate inside the company to get things fixed in time, it's a boon to your reputation even if the reporter gets to publicly disclose the weakness.<p>Now they still have the public disclosure of the weakness, but they get the added reputation hit of seemingly not caring, or not being able to get serious security issues that jeopardize their users fixed. Not a good look for a company supposedly obsessed with users' privacy.