4 ms·

As mentioned the program is currently invite only currently (ie, https://twitter.com/i0n1c/status/761349794510036992 https://twitter.com/i0n1c/status/761349794

• Jerry2 10y ago
  From the article: >However, Apple won’t turn away new researchers if they provide useful disclosures, and plans to slowly expand the program. I'm reading this as: if you find a serious bug and report it, you'll get the money.
  • bjterry 10y ago
    I read that as: if you find a bug and report it, you may get invited into the formal bug bounty program (but may not get a payout on the first one). No idea if that's right though.
    • IBM 10y ago
      The Reuters report has some details about why they limited it: >Apple said it decided to limit the scope of the program at the advice of other companies that have previously launched bounty programs. Those companies said that if they were to do it again, they would start by inviting a small list of researchers to join, then gradually open it up over time, according to Apple. Security analyst Rich Mogull said that limiting participation would save Apple from dealing with a deluge of "low-value" bug reports. "Fully open programs can definitely take a lot of resources to manage," he said. http://www.reuters.com/article/us-cyber-blackhat-apple-idUSKCN10F2TX http://www.reuters.com/article/us-cyber-blackhat-apple-idUSK...
      • amenghra 10y ago
        True, but it's not like Apple doesn't have the resources to manage an open submission program.
        • IBM 10y ago
          They may have financial resources but I doubt their security engineers would want to deal with the deluge.
        • duaneb 10y ago
          Maybe they want to invest cautiously. Seems smart to me.
        • deleted 10y ago
          [deleted]
        • coldtea 10y ago
          It's not about throwing money or people at a problem, it's the overhead that lowers its efficiency and agility.
      • NEDM64 10y ago
        Then it seems like a job to me, if it is, then they should pay a salary.
        • ghshephard 10y ago
          If it was a salaried job you would have to sign a Non-Disclosure, assign all intellectual property rights to Apple, ensure that you have good work attendance, be responsive to what your manager tells you to do, etc, etc... I'm sure there are a lot of security researchers who would like to dabble in dozens of companies products, without being told what they had to do every day, yet still be compensated.
  • Godel_unicode 10y ago
    I haven't read the article, but I was at the announcement and your take is exactly how it was clarified in the room. If you do good work and report it, you'll get paid accordingly.
    • robzyb 10y ago
      That setup doesn't make any sense to me. Either its an open program or a closed program. A closed program that allows submissions from others is an open program. What reasons what they have to do it this way? My first guess is to tick some checkbox.
      • ghshephard 10y ago
        It's pretty straightforward. Apple wants to start off slow, with a small group of people, and develop the quality of the program. By being explicitly closed, but implicitly open, they can focus their energy on the invited researchers, and ensure a high-level of support/response. If they had explicitly said that it was an open program, they would have had to scale up their efforts to support the entire world of vulnerability researchers, or risk disappointing people for not responding quickly enough. Put another way - if you are not part of the invited group, and you submit an issue, but do so poorly, or without a clear Proof-of-Concept, and concise description, you can reasonably expect to hear no response from Apple, with no grounds to complain that they ignored you. But, at the same time, if you have a clear exploit, well documented, with impact and proof-of-concept, then their is still an avenue to submit it to Apple, but it's up to Apple to decide how they wish to prioritize.
        • robzyb 10y ago
          > Put another way - if you are not part of the invited group, and you submit an issue, but do so poorly, or without a clear Proof-of-Concept, and concise description, you can reasonably expect to hear no response from Apple, with no grounds to complain that they ignored you. But, at the same time, if you have a clear exploit, well documented, with impact and proof-of-concept, then their is still an avenue to submit it to Apple, but it's up to Apple to decide how they wish to prioritize. Thanks, that does make a lot of sense. My main exposure to bug bounty programs has been through the blog post of submitters, that don't give much insight to the resources/support that e.g. Apple would need to give.
  • jim-greer 10y ago
    I imagine if you find a good bug and aren't on their list, you could bring in someone who is to help out...
    • jonknee 10y ago
      ... Or Apple could just be like every other bug bounty and pay out regardless of if you're on a white list or not.
      • kefka 10y ago
        Someone's always willing to pay. It just might be in bitcoin on some .onion site :)