Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The simple solution is a two-tiered system.

The submitter can check "This report is security sensitive or has confidential information that should not be shared further than necessary to fix the bug."

Most projects have this in the form of a default-public bug tracker, and private emails to the developer or security@ mailing list.

It's not difficult to have both private and public bugs where the submitter chooses which is appropriate.



I love it when people think they know better than Apple, and propose simplistic non-solutions as solutions, as if some amazing people at Apple had not already spent countless hours thinking this through at a deep level.

The submitter doesn't always know when they are submitting sensitive or confidential information. And that's not going to be fixed any time soon or with any simple solution. There are system diagnostics reports that can be many megabytes and contain potentially confidential information, and it would be entirely unreasonable to expect a user, even a developer user, to know how to trawl through all of these reports with a level of expertise to discern every possible case of leakage.

And that's just the personal / private information... which, by the way, Apple from what I've seen seems to strive to keep OUT of the diagnostic reports, but that doesn't mean they are perfect at this. And that doesn't even begin to address the information that might be, totally unknown to the submitter, exploitable in other ways.

As far as what other projects have, macOS is a highly complex operating system along with a tightly integrated ecosystem of apps and services, which is designed to, and relied on to, "just work"... while most other systems are either much smaller, or are not maintaining a level of smooth operation and security that can match the "it just works" level of reliability standard that macOS aims for. So maybe the bug reporting systems of all those other projects are appropriate for those other projects, but that doesn't make those systems and their practices appropriate for macOS.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: