So by now you've probably heard Group FaceTime got switched off entirely last Monday, because it turned out you could add yourself to a call and hear audio from the other person's phone before they even picked up. Apple flipped the server-side kill switch and promised a real fix is coming "later this week," which, fine, but that's not actually the part of this story that's been stuck in my head all weekend.
The part that gets me is who found it, and what happened after.
It was a 14-year-old in Arizona named Grant Thompson. He was just trying to get a buddy into a Fortnite squad, called him on FaceTime, and while he was waiting for the guy to pick up he added a third person to make it a group call. And somehow that made his friend's phone start transmitting audio before the call was ever accepted. No tap-to-answer, nothing. His mom Michele apparently spent something like a week and a half trying to get Apple's attention about this. Emails. A fax, an actual fax, in 2019. Phone calls to support. A written letter. She even messaged Apple's security disclosure people directly. Nothing. It wasn't until some developer posted a video of the bug on Twitter last Monday that it exploded and Apple acted within hours.
Hours, once it was public and embarrassing. A week and a half of nothing when it was just a mom with a fax machine.
I don't think this is really an Apple-is-evil story, to be clear, I still like my phone fine and I'm not switching to whatever Google's doing this week. But it's a pretty clean example of something I've griped about here before, which is that "report a security bug" pipelines at big companies are basically built for other engineers, not for regular people who stumble into something scary by accident. If you don't know the magic words, or you don't have a Twitter following big enough to make noise, you might just get ignored. That's not a hypothetical, that's literally what happened here, documented, with dates.
And can we talk about how absurd the bug itself is for a second. Group FaceTime lets you eavesdrop on someone through their own phone's microphone before they've agreed to talk to you. That's not a UI glitch or a typo in a settings menu, that's a fundamental "wait, how did nobody catch this in testing" kind of bug. I use FaceTime constantly, my parents are two states away and it's basically how my mom checks that I'm still eating vegetables, so this one actually rattled me a little. I turned it off on my own phone the second I saw the thread Monday night, before Apple even pushed anything server-side, just out of pure paranoia. Probably unnecessary in hindsight but I wasn't taking chances with my laptop mic sitting six feet from my desk either (yes I'm one of those people with a sticky note over the camera, judge away).
What I keep coming back to though is the timeline. Bug found around January 19th. Apple contacted through basically every normal channel almost immediately after. Nothing happens for over a week. Goes viral on a Monday. Fixed at the server level by that same afternoon. If a company can flip a switch and neuter a whole feature in a few hours once enough people are watching, they had that capability the entire time Michele Thompson was trying to fax them. The bottleneck was never technical.
Grant apparently wants to get some kind of credit or bug bounty payout for this, and honestly I hope he gets it, plus maybe a scholarship check on top for the trouble. Kid found something that got the feature pulled from a billion-plus phones. That's more real-world security research than most CS sophomores manage in four years, and he did it trying to set up a video game session, not applying for a job. There's something very 2019 about that whole sentence, and I mean that as a compliment to him and not much else.
Anyway. Group FaceTime is off, my mom is annoyed she can't loop my sister in on our Sunday calls anymore, and I'll believe it's actually fixed when the update lands and not before.