Darwin audit finds flaws that affect Mac OS X Panther

The company originally found the flaws in June, but only published them to a private list of customers and did not notify Apple.

A security firm conducts an audit of an operating system and DOES NOT NOTIFY THE OS MAKER OF THE FLAWS THEY FOUND????

And then later they go public without even giving the company a chance to fix the problems first?

Is that f**ked up or what?

I have been in the information security field for over 10 years and I have NEVER heard of a company that would NOT notify the vendor before making a vuln public. Should that line really read, "and notified Apple"? Was "not" just someone accidently typing notify twice?

I certainly hope so - for otherwise, this seems rather insane.

-Eric

After checking the original CNET article, it seems as though they really did NOT notify Apple. That is the height of hubris and based on the information on their web site seems to fit with their mentality. They seem to be a group of "grey hat" hackers that try to push the envelope of legality for computer security.

In this case, they seem to have left the flaws in place for six months without notifying Apple for the pure reason of showing their prowess to those companies that have signed up for their service and to flex their muscles to the rest of the hacking community. "Street Cred" is key to crackers/hackers and on its face, this seems designed to provide that.

However, respectibility is key to getting and keeping the large customers that are crucial to long term survival. Unfortunately for "Immunity", they seem to lack the proper concern for protection, valuing self-promotion instead.

No respectable researcher would act in this irresponsible of a manner.

-Eric

The actual linked article itself states it this way: "The company originally found the flaws in June and published them to a private list of customers but did not notify Apple."

The word "but" in the above suggests that they really didn't notify the vendor before making the vulnerablities public.

The want Apple to pay to be on the list...

Microsoft? Sun? Red Hat? Microsoft has done stuff like this in the past, at least with "independent" testing labs.

Who subscribes to audits of operating systems that they didn't write?