OSNews

I agree, even though I also understand his side of it. The man is obviously extremely intelligent, and should be paid for what he does best. Basically, however, what he's saying is he'd rather make money than prevent others from getting royally screwed, a prime example of the selfish greed-motivated mentality that seems to be so prevalent today, and one that will ultimately screw us all for good. When you come right down to it, that's pathetic.

I do not see anything wrong with his mentality. It is not his job to help out companies unless the company is paying him directly to do so. At least that is how I see it. There is nothing wrong with using your talents and making money off of it. If Apple was really that concerned about security then they would pay him big bucks to bang away at their software all day. But they dont as far as I know.

Microsoft on the other hand holds these types of security competitions every year and they are reported on the web as well and they actually pay those hackers.

Sure Apple is based on a NIX OS and therefore it has the advantage in security but thats not how I am seeing it nowadays. It seems that it is an OS with a somewhat false sense of security now? I am not saying Microsoft is better dont get me wrong. But I am saying OS X is not necessarily better especially if a hacker comes out and downright says that the OS is easy to screw up!

I always believe being paranoid is the best way to go when it comes to security. From what I am seeing Windows has definitely improved its security especially since they have had no choice but to go up lol but it seems OS X has just remained stagnant in that department but people think because its a NIX based OS they are inherently secure. It could be true to a certin extent but I would rather be paranoid than a victim.

He sat on the vuln for a year intentionally saving it for this competition. How many criminals found that same vulnerability in that time? How many users where left hanging unknowingly. Not even a bug report.

Wanting monetary return is one thing; we all have to eat. That suggests approaching the relevant company in a timely manner though. We want companies to view vulns and issue a patch the day after they are notified of it but that has to go both ways. This is starting to sound like Microsoft business strategy; release the "innovations" as slow as you can to maximize shareholder profits rather than user benefits... booo..

No doubt he's smarter than me but I think the enthusasm with which he's pushing to be paid and the decision to leave users vulnerable for a money shot perl necklace is in bad taste.

Come on Sec devs, those of us in infosec that don't do Dev work are out here mitigating when we could have patched long ago and had safer users.

Why?

Apple decided not to release their code, why would they have a right to know the exploits other people find for them?

They've chosen that model, now they have to deal with the downsides.

Since the exploit in this case is for Safari Apple are in fact releasing the code, so if were a question of reciprocity the guy has no excuse.

But availability, or "openness" if you will, of the source is not an issue here. This guy supposedly is a white hat (a.k.a. "security researcher") and as such is supposedly trying to find exploitable holes so they can be fixed before people get harmed. Sitting on an exploit for a year so you can get a free laptop and 15 min of fame is certainly black hat and is even nearly criminal.

He is free to not research Apple's software and get a paying gig for someone else or apply for a job at Apple.

Allright, so by this logic if you find a fatal flaw in, say, a car from Ford the right and responsible thing to do (since Ford's designs arent "open source") would be to sit on it for an undetermined abount of time until you've find a way to trigger it. once you've done that you do NOT tell the public what the problem is but instead you try to "extort" money from Ford in exchange for not letting anyone know.
Yes, that's surely a society I'd love to live in.
Get this straight, it has NOTHING to do with if Apple's product is open or not, it's about the risk the consumers and the general public is exposed to.

The exploit Miller used last year was in the open-source WebKit part of Safari. (In fact, it was in a third-party library used by WebKit, and not a bug in Apple's code as such.) It's likely, though hardly guaranteed, that the bug he used this year is also in WebKit, since he's said before that he discovered it at the same time. (By the way, he found the bug by reading source code. Pretty cool, huh?)

Since Chrome uses all the same WebKit code as Safari, it's likely that both of these bugs are (or were) present in Chrome. The exploits would still be very different, though: The initial bug will get you through the front door, but it won't lead you to the self-destruct button.

It's true that Safari's interface is closed-source, but it's also true that fixing a WebKit bug would benefit the open source community, because that's public code used by a number of browsers.

It's about the users. Why should the users be left vulnerable to a known exploit just because Apple's business model isn't the same as Red Hat's? Do you extend the same towards Microsoft? It's ok for Microsoft's poor quality control to cause loss among the user base because they don't follow a FOSS business strategy?

Please..

So, what code are you referring to? Do you know the exploit? Also, if said code was open, who now is to blame?

Selling bugs/exploits for money is pretty low... He is almost in the same league with virus writers...

I don't think he intends to sell to some criminal organization. Which I am sure he would have no problems doing - for more money too. And selling exploits to the makers of the software - what's wrong with that? He spends a lot of time and efforts to find these exploits. Why should a software company, that makes a lot of money from that software be entitled to get the results of his hard labour for free? That's just like saying that getting paid to develop software is low.

I can understand how it's not easy work. You get a lab, you get the product, you fuzz it along with what ever other methods you use. That all takes time. That takes long periods between pay cheques if your working purly contract/bounty. Charlie absolutely deserves to get paid. He should have presented the bug and reached a reasonable agreement for compensation a year ago though. It's not that he shouldn't be paid, it's that intentionally leaving the users who can't fix there own systems open to damages becomes very questionable.

Personally, I'd love to see the user base turn around on MS and Apple demanding higher product quality. I'd much rather see a product already designed better trump both those retail items. Until either of those outcomes, we need all we can do to protect ourselves and clients.

I wonder if this won't induce sooner or later a DMCA violation lawsuit against him.