4 ms·

Article quote-ee here. You're not describing the same thing the people in the article were describing. The bugs that Apple is looking for take time and resourc

by dguido 9y ago

Article quote-ee here. You're not describing the same thing the people in the article were describing. The bugs that Apple is looking for take time and resources to find yet you can't depend on the $200k of revenue to feed yourself. E.g., even after you spend months of real work you sometimes fail and get no payout. That's an acceptable risk for a $3k bug bounty. It's not at $200k. Every other issue you cited is secondary to the economic one.

saurik 9y ago
I am well aware of how finding these bugs work (I recommend looking at who I am, if you don't know, as your response kind of tells me you don't ;P). I believe the article is not actually focusing on the same problem as Apple's bug bounty program.
- dguido 9y ago
  I know precisely who you are, and I think you're jumping to conclusions in this case. People love to read morals, ethics, and politics into analyzing bug bounty submissions, but none of that is the primary factor here. In general, it's not possible to "stumble upon" a $200k bug like the kind Apple is looking for, you have to set out with the intention to find one and work for it. But you're not on a contract and you're not getting paid the whole time. You only get paid on delivery and there's a high chance you won't have anything to deliver. It's just too much risk for an individual or company to commit months of time at potentially $0/hour. You alluded to it, and it bears mentioning that there is a balancing act with future revenue streams too. If you set up the process to find one $200k bug then presumably you want to use all that know-how to find a second one. But reporting the first one to Apple will, generally, kill your entire revenue stream as Apple knows all your secrets now. In general, working on $200k bug bounties is a bad business proposition. Period.
  - IBM 9y ago
    What do you think the payouts should be?
    - dguido 9y ago
      There's a variety of models that others have experimented with, and they all tend to fail at bugs this deep. For instance, Google tried a thing where you open a bug ticket once you think you've found an issue and you stream out everything you tryalong the way. I think there were ongoing or partial rewards and it was Android-centric. I'm pretty sure approx. 0 people took them up on it. Microsoft also had/has mitigation bounties for around the same dollar amounts and it turned out nearly the same: lower than expected interest given the price point. Most of the interested parties tend to be academics, for fairly obvious reasons when you think about the economics of it all. I think that if Apple wants to find bugs this deep in specialized, hard-to-audit surfaces within iOS, they ought to hire experts at expert rates and provide them the tools they need to look. In my perfect world, I would hire an expert consulting firm at their market base rates and then offer bonuses for findings on top of it. I would make the engagement low intensity and long in length, to build competency and familiarity with the codebase over time.
      - IBM 9y ago
        It seems to me the actual solution is to hire experts as employees. That solves the "can't put food on the table" problem. It's probably a lot more efficient and effective use of their cash. As far as I know Apple has already done this over the years.
        willstrafach 9y ago
        They absolutely do and have continued to do so vigorously. The bug bounty program is in addition to this.
      - deleted 9y ago
        [deleted]
      - Godel_unicode 9y ago
        > they ought to hire experts at expert rates and provide them the tools they need to look. I'm really curious where this idea that the existence of a bug program means they must have no in-house bug hunting team. A competent, deep pocketed corporation (which I think we all agree Apple is) would certainly do both. Want to hunt Apple bugs but not work for them? Do that. Want to hunt bugs with a steady salary? Do that. Edit: now with link to 197 job postings! https://jobs.apple.com/us/search#&ss=Sr.%20Security%20Engineer&t=0&so=&lo=0*USA&pN=0 https://jobs.apple.com/us/search#&ss=Sr.%20Security%20Engine...
  - cannabis_sam 9y ago
    >People love to read morals, ethics, and politics into analyzing bug bounty submissions, but none of that is the primary factor here. Just disregarding these things and justify it with "economics" or "it's bad business" doesn't make ethics disappear. I'm guessing you wouldn't sell exploits to ISIS even if they were the highest bidder..? What about North Korea? China? Russia? Syria? The US? The US with Trump in charge? I personally like tptacek's comment on this from last year: >None of them are adequate compensation for the full-time work of someone who can find those kinds of bugs. Nor are they meant to be. If you can, for instance, find a bug that allows you to violate the integrity of the SEP, you have a market value as a consultant significantly higher than that $100k bug bounty --- which will become apparent pretty quickly after Apple publicly thanks you for submitting the bug, as they've promised to do. https://news.ycombinator.com/item?id=12230677 https://news.ycombinator.com/item?id=12230677
    - kk_cz 9y ago
      > which will become apparent pretty quickly after Apple publicly thanks you for submitting the bug, as they've promised to do This is the same twisted logic that people try to use to hire photographers or graphic designers to work for them for free, because they will get "exposure". If someone does something valuable for you, you should pay, no matter how famous your brand is. And Apple has enough cash to spare.
      - cannabis_sam 9y ago
        It's not though, since the alternative to disclosing the bug to apple is to either hoard it for yourself or sell it to someone, both of which keep the attack vector open and millions of users at risk. That's where the ethical discussion comes in, and there's not really a parallel to the case with the photographer/graphic artist. (And just to be clear, I do think that fair compensation is a part of that ethics discussion, but it doesn't trump other concerns.) (edit: typo)
        kk_cz 9y ago
        I was not addressing the ethical question involved - just the logic behind "Apple thanks you, therefore you should be happy". If Apple is not providing reasonable money compensation to white hat security researchers then they are willingly leaving this space opened for black hats.
  - saurik 9y ago
    We don't disagree on your conclusion: where we disagree is on the goal of these bug bounty programs and (thereby) how we can judge if they work. The value of a bug to the black market can be insanely high: it just isn't possible for Apple to outbid the negative ramifications a bug can have on the outside world. You are always going to get more money by going to the black market than by selling it to Apple. So, I am going to say it again: I believe the article is not actually focusing on the same problem as Apple's bug bounty program. The issue you were quoted for in the article is "how do you get someone already doing this to give the bug to Apple instead of selling it at market rates". Well, if someone is willing to sell it at market rates, then Apple is kind of screwed as that person likely does not have much in the way of morals and Apple is never going to outbid the market rate. Now, you are focused on a different issue: "how do you incentivize people who otherwise wouldn't work on this stuff at all to work on this stuff". This still isn't something Apple is focused on. If you want to do this but just need a steady salary, I bet Apple would love to hire you. What a bug bounty program does is it makes the situation that does sometimes come up where you stumble across an issue while working on something else, or you just got really curious about a thing and find yourself two months later having "wasted your life" on scavenging a bug, or you have some other motivation (consulting or academic work) to be panning for gold, and now you don't know what to do next: rather than doing nothing, you give it to Apple for some reasonable payout. If you were morally OK with selling your bug on the black market, Apple can't be going around trying to outbid evil, so that can't be a goal of this program and you can't judge it for not solving it. And if you wouldn't have spent your time on this at all, and would have instead gone off to work on some other project, Apple isn't trying to replace "jobs": they have a massive security staff of some extremely talented people (many of whom at this point used to play for the other side).
    - jasode 9y ago
      > You are always going to get more money by going to the black market than by selling it to Apple. [...] , then Apple is kind of screwed as that person likely does not have much in the way of _morals_ [...] If you were morally OK with selling you really bug on the black market, Apple can't be going around trying to outbid _evil_, (_emphasis_ was mine) I agree with you that dguido has framed Apple's Bug Bounty program incorrectly. The money amounts are deliberately not structured as a incentive to build a remote "red team"[1] to do speculative work. (I would go farther to say it would be folly to attempt to create such a salaried red team to uncover security bugs since history has shown that many types of security exploits that come to light had leaps of creativity that exceeded the imaginations of the systems' designers.) However, I'd add some nuance to your moral scenarios by stating that a sophisticated buyer of Apple bugs would not present it to the hackers as "selling to evil entities". Instead they're actually selling to the "good guys" -- it's just a different set of good guys from Apple. (E.g. Zerodium may in some instances act as a front to buy the bug on behalf of NSA/FBI/CIA). The article talks about hackers that are willing to go to dinner with Apple and meet-&-greet Craig Federighi. Since these "security researchers" are willing to show their faces to Apple, we'd probably classify them as "white hat" or "grey hat" hackers instead of evil "black hat" hackers. Therefore, one way to persuade these researchers to sell the secret to the black market is to convince them they are still serving "the greater good"... it's just the black market group is paying $500k instead of Apple's $200k. Summary of my interpretation of Apple's Bug Bounty: 1) Apple did not set it up to incentivize speculative work. This looks like an economic design flaw but but it actually isn't. 2) Apple is not trying to persuade immoral black hat hackers to sell to Apple. Apple already knows the amounts are too small to compete there. The audience they are trying to appeal to is the white/grey hats. [1] https://en.wikipedia.org/wiki/Red_team https://en.wikipedia.org/wiki/Red_team
- charsifood 9y ago
  Logicians on HN: Is there a special name for Appeal to Authority when applied to oneself?
  - Nadya 9y ago
    It would still be an appeal to authority. However an appeal to authority, while sometimes fallacious, is not always fallacious. [0] https://en.wikipedia.org/wiki/Argument_from_authority#Valid_forms https://en.wikipedia.org/wiki/Argument_from_authority#Valid_...
  - saurik 9y ago
    I don't think you know what "appeal to authority" means ;P.
    - charsifood 9y ago
      Enlighten me.
      - saurik 9y ago
        You know, I didn't think I wanted to dignify this with this level of response, but maybe someone else is going to get confused and I have terrible insomnia: you responded to someone (me) telling someone else "the information you think is relevant to changing my mind is information you should know I already have, which means there is some framing problem in our conversation that needs to be addressed" with a (slightly indirect, and thereby to me incredibly snippy sounding and extra insulting) comment claiming that is an "appeal to authority", when that statement wasn't even an argument and so wasn't an "appeal": you can't read that comment from me as "I am right because of who I am", as it is simply "you are trying to convince me of your point using information I do not disagree with (and which you should know I have, and so should probably know I don't disagree with...)" and was nothing more than a lead-in to my actual point, which was "given that I know that and that we don't even disagree there, you should go back and notice the following thing about what I said: we are talking about different points", which was the actual statement in that comment: I believe the article is not actually focusing on the same problem as Apple's bug bounty program.

by dguido 9y ago

saurik 9y ago

I am well aware of how finding these bugs work (I recommend looking at who I am, if you don't know, as your response kind of tells me you don't ;P). I believe the article is not actually focusing on the same problem as Apple's bug bounty program.

dguido 9y ago
I know precisely who you are, and I think you're jumping to conclusions in this case. People love to read morals, ethics, and politics into analyzing bug bounty submissions, but none of that is the primary factor here. In general, it's not possible to "stumble upon" a $200k bug like the kind Apple is looking for, you have to set out with the intention to find one and work for it. But you're not on a contract and you're not getting paid the whole time. You only get paid on delivery and there's a high chance you won't have anything to deliver. It's just too much risk for an individual or company to commit months of time at potentially $0/hour. You alluded to it, and it bears mentioning that there is a balancing act with future revenue streams too. If you set up the process to find one $200k bug then presumably you want to use all that know-how to find a second one. But reporting the first one to Apple will, generally, kill your entire revenue stream as Apple knows all your secrets now. In general, working on $200k bug bounties is a bad business proposition. Period.
- IBM 9y ago
  What do you think the payouts should be?
  - dguido 9y ago
    There's a variety of models that others have experimented with, and they all tend to fail at bugs this deep. For instance, Google tried a thing where you open a bug ticket once you think you've found an issue and you stream out everything you tryalong the way. I think there were ongoing or partial rewards and it was Android-centric. I'm pretty sure approx. 0 people took them up on it. Microsoft also had/has mitigation bounties for around the same dollar amounts and it turned out nearly the same: lower than expected interest given the price point. Most of the interested parties tend to be academics, for fairly obvious reasons when you think about the economics of it all. I think that if Apple wants to find bugs this deep in specialized, hard-to-audit surfaces within iOS, they ought to hire experts at expert rates and provide them the tools they need to look. In my perfect world, I would hire an expert consulting firm at their market base rates and then offer bonuses for findings on top of it. I would make the engagement low intensity and long in length, to build competency and familiarity with the codebase over time.
    - IBM 9y ago
      It seems to me the actual solution is to hire experts as employees. That solves the "can't put food on the table" problem. It's probably a lot more efficient and effective use of their cash. As far as I know Apple has already done this over the years.
      - willstrafach 9y ago
        They absolutely do and have continued to do so vigorously. The bug bounty program is in addition to this.
    - deleted 9y ago
      [deleted]
    - Godel_unicode 9y ago
      > they ought to hire experts at expert rates and provide them the tools they need to look. I'm really curious where this idea that the existence of a bug program means they must have no in-house bug hunting team. A competent, deep pocketed corporation (which I think we all agree Apple is) would certainly do both. Want to hunt Apple bugs but not work for them? Do that. Want to hunt bugs with a steady salary? Do that. Edit: now with link to 197 job postings! https://jobs.apple.com/us/search#&ss=Sr.%20Security%20Engineer&t=0&so=&lo=0*USA&pN=0 https://jobs.apple.com/us/search#&ss=Sr.%20Security%20Engine...
- cannabis_sam 9y ago
  >People love to read morals, ethics, and politics into analyzing bug bounty submissions, but none of that is the primary factor here. Just disregarding these things and justify it with "economics" or "it's bad business" doesn't make ethics disappear. I'm guessing you wouldn't sell exploits to ISIS even if they were the highest bidder..? What about North Korea? China? Russia? Syria? The US? The US with Trump in charge? I personally like tptacek's comment on this from last year: >None of them are adequate compensation for the full-time work of someone who can find those kinds of bugs. Nor are they meant to be. If you can, for instance, find a bug that allows you to violate the integrity of the SEP, you have a market value as a consultant significantly higher than that $100k bug bounty --- which will become apparent pretty quickly after Apple publicly thanks you for submitting the bug, as they've promised to do. https://news.ycombinator.com/item?id=12230677 https://news.ycombinator.com/item?id=12230677
  - kk_cz 9y ago
    > which will become apparent pretty quickly after Apple publicly thanks you for submitting the bug, as they've promised to do This is the same twisted logic that people try to use to hire photographers or graphic designers to work for them for free, because they will get "exposure". If someone does something valuable for you, you should pay, no matter how famous your brand is. And Apple has enough cash to spare.
    - cannabis_sam 9y ago
      It's not though, since the alternative to disclosing the bug to apple is to either hoard it for yourself or sell it to someone, both of which keep the attack vector open and millions of users at risk. That's where the ethical discussion comes in, and there's not really a parallel to the case with the photographer/graphic artist. (And just to be clear, I do think that fair compensation is a part of that ethics discussion, but it doesn't trump other concerns.) (edit: typo)
      - kk_cz 9y ago
        I was not addressing the ethical question involved - just the logic behind "Apple thanks you, therefore you should be happy". If Apple is not providing reasonable money compensation to white hat security researchers then they are willingly leaving this space opened for black hats.
- saurik 9y ago
  We don't disagree on your conclusion: where we disagree is on the goal of these bug bounty programs and (thereby) how we can judge if they work. The value of a bug to the black market can be insanely high: it just isn't possible for Apple to outbid the negative ramifications a bug can have on the outside world. You are always going to get more money by going to the black market than by selling it to Apple. So, I am going to say it again: I believe the article is not actually focusing on the same problem as Apple's bug bounty program. The issue you were quoted for in the article is "how do you get someone already doing this to give the bug to Apple instead of selling it at market rates". Well, if someone is willing to sell it at market rates, then Apple is kind of screwed as that person likely does not have much in the way of morals and Apple is never going to outbid the market rate. Now, you are focused on a different issue: "how do you incentivize people who otherwise wouldn't work on this stuff at all to work on this stuff". This still isn't something Apple is focused on. If you want to do this but just need a steady salary, I bet Apple would love to hire you. What a bug bounty program does is it makes the situation that does sometimes come up where you stumble across an issue while working on something else, or you just got really curious about a thing and find yourself two months later having "wasted your life" on scavenging a bug, or you have some other motivation (consulting or academic work) to be panning for gold, and now you don't know what to do next: rather than doing nothing, you give it to Apple for some reasonable payout. If you were morally OK with selling your bug on the black market, Apple can't be going around trying to outbid evil, so that can't be a goal of this program and you can't judge it for not solving it. And if you wouldn't have spent your time on this at all, and would have instead gone off to work on some other project, Apple isn't trying to replace "jobs": they have a massive security staff of some extremely talented people (many of whom at this point used to play for the other side).
  - jasode 9y ago
    > You are always going to get more money by going to the black market than by selling it to Apple. [...] , then Apple is kind of screwed as that person likely does not have much in the way of _morals_ [...] If you were morally OK with selling you really bug on the black market, Apple can't be going around trying to outbid _evil_, (_emphasis_ was mine) I agree with you that dguido has framed Apple's Bug Bounty program incorrectly. The money amounts are deliberately not structured as a incentive to build a remote "red team"[1] to do speculative work. (I would go farther to say it would be folly to attempt to create such a salaried red team to uncover security bugs since history has shown that many types of security exploits that come to light had leaps of creativity that exceeded the imaginations of the systems' designers.) However, I'd add some nuance to your moral scenarios by stating that a sophisticated buyer of Apple bugs would not present it to the hackers as "selling to evil entities". Instead they're actually selling to the "good guys" -- it's just a different set of good guys from Apple. (E.g. Zerodium may in some instances act as a front to buy the bug on behalf of NSA/FBI/CIA). The article talks about hackers that are willing to go to dinner with Apple and meet-&-greet Craig Federighi. Since these "security researchers" are willing to show their faces to Apple, we'd probably classify them as "white hat" or "grey hat" hackers instead of evil "black hat" hackers. Therefore, one way to persuade these researchers to sell the secret to the black market is to convince them they are still serving "the greater good"... it's just the black market group is paying $500k instead of Apple's $200k. Summary of my interpretation of Apple's Bug Bounty: 1) Apple did not set it up to incentivize speculative work. This looks like an economic design flaw but but it actually isn't. 2) Apple is not trying to persuade immoral black hat hackers to sell to Apple. Apple already knows the amounts are too small to compete there. The audience they are trying to appeal to is the white/grey hats. [1] https://en.wikipedia.org/wiki/Red_team https://en.wikipedia.org/wiki/Red_team
charsifood 9y ago
Logicians on HN: Is there a special name for Appeal to Authority when applied to oneself?
- Nadya 9y ago
  It would still be an appeal to authority. However an appeal to authority, while sometimes fallacious, is not always fallacious. [0] https://en.wikipedia.org/wiki/Argument_from_authority#Valid_forms https://en.wikipedia.org/wiki/Argument_from_authority#Valid_...
- saurik 9y ago
  I don't think you know what "appeal to authority" means ;P.
  - charsifood 9y ago
    Enlighten me.
    - saurik 9y ago
      You know, I didn't think I wanted to dignify this with this level of response, but maybe someone else is going to get confused and I have terrible insomnia: you responded to someone (me) telling someone else "the information you think is relevant to changing my mind is information you should know I already have, which means there is some framing problem in our conversation that needs to be addressed" with a (slightly indirect, and thereby to me incredibly snippy sounding and extra insulting) comment claiming that is an "appeal to authority", when that statement wasn't even an argument and so wasn't an "appeal": you can't read that comment from me as "I am right because of who I am", as it is simply "you are trying to convince me of your point using information I do not disagree with (and which you should know I have, and so should probably know I don't disagree with...)" and was nothing more than a lead-in to my actual point, which was "given that I know that and that we don't even disagree there, you should go back and notice the following thing about what I said: we are talking about different points", which was the actual statement in that comment: I believe the article is not actually focusing on the same problem as Apple's bug bounty program.