You don't necessarily need vendor statements to confirm whether a system is affected. Reputable third-party research is useful, too. Vendor confirmation is only really needed to state patch availability. And I believe (haven't looked at the
Ask Different answers yet) I saw something about Apple releasing patches elsewhere.