I don't understand why they don't just pay them to work on Asahi and then they can learn directly from all their findings?
This is actually the best of both world, they stay independents, they get paid, Apple fixe the reported exploit.
Here's the clip where Asahi Lina says she received $150,000 for CVE-2022-32947:
- https://youtu.be/hDek2cp0dmI?t=11451
And Apple credited them under GPU Drivers for macOS Ventura 13:
- https://support.apple.com/en-us/HT213488#:~:text=CVE%2D2022%...
Related coverage:
- https://secry.me/explore/news/cve-2022-32947-first-critical-...
The issue has never been finding the bugs. It's having the capacity to fix the bugs.
And when you are this early in the OS release cycle (we are only at 14.1) there are inevitably a lot of P1 issues that limited resources are competing to fix.
Only 14/16-inch models where users have explicitly disable ProMotion and are desperate to boot into the RecoveryOS.
To ship this severity of bug in an X.6 release too is definitely very eyebrow raising.
I hope this was a joke :)
The worst thing that Apple did to themselves is force everything and everyone into a yearly release cycle
Similar reason as to why companies have bug bounties; they want to incentivize hackers to report bugs through official channels early enough in development that they can get patched before release and before tech journalists write articles about them. They don't want to find out that their products have bugs via social media. Even if that process happens out in the open via a Github issue, getting giant problems like this caught before release and quickly escalated internally through official channels would go a long way towards mitigating article titles like this.
Having said that, does Apple care about the Register or HN? Probably not? And assuming that Apple did care about bad PR among extreme power-users, would Asahi Linux want to be paid by Apple to do testing on their releases? That's also not necessarily a given, the team would have to decide if they wanted to have a more official relationship with the company or not.