Episode 291 - Everyone sucks at vulnerability disclosure

<p><a href="https://twitter.com/joshbressers" rel= "nofollow">Josh</a> and <a href="https://twitter.com/kurtseifried" rel="nofollow">Kurt</a> talk about recent events around Apple and Microsoft disclosing security vulnerabilities. Microsoft usually does a good job, but Apple has a long history of not having a great bug bounty or vulnerability disclosure policy. None of this is simple, but hopefully you'll have some fun and learn a bit about the whole vulnerability disclosure process.</p> <h2>Show Notes</h2> <ul> <li><a href= "https://apple.slashdot.org/story/21/09/24/1515243/researcher-dumps-three-ios-zero-days-after-apple-failed-to-fix-issues-for-months" rel="nofollow">Apple 0days</a></li> <li><a href= "https://www.theregister.com/2021/09/27/microsoft_exchange_autodiscover/" rel="nofollow">Microsoft Exchange flaw</a></li> <li><a href="https://thisishowtheytellmetheworldends.com/" rel= "nofollow">THIS IS HOW THEY TELL ME THE WORLD ENDS</a></li> <li><a href= "https://www.linuxfoundation.org/blog/how-to-report-security-vulnerabilities-to-the-linux-foundation/" rel="nofollow">Linux Foundation Vulnerability Disclosure</a></li> <li><a href= "https://blog.joda.org/2021/09/big-problems-at-timezone-database.html" rel="nofollow">Timezone problem</a></li> </ul>