5 ms·

Apple has a bug bounty program where they'll legitimately pay you to report bugs directly to them. What's with everyone reporting them to Twitter instead and fo

by eamann 9y ago

Apple has a bug bounty program where they'll legitimately pay you to report bugs directly to them. What's with everyone reporting them to Twitter instead and forgoing the extra cash?

zitterbewegung 9y ago
Submitting a bug bounty takes time. Also, informing people of security issues can be a virtue which is its own reward.
gcb0 9y ago
the bounties are low. and registering to those things require some loss of anonymity before you do get paid. those are users dogfooding a product they paid for. and probably well off already, so the twitter bragging rigths is more valuable than the loss of anonymity + $500.
deleted 9y ago
[deleted]
bpicolo 9y ago
This doesn't seem like it would qualify under their categories. Not to mention, their bug bounty program info is nowhere to be found. I see tech sites reporting that they offer one but nothing on any apple site.
AdmiralAsshat 9y ago
There's a case to be made for public shaming, sometimes. You're leaving it up to Apple to decide whether they want to pay you or not; they might deny the bounty for some reason, while still fixing the bug. Now you get nothing, in addition to having given Apple time to sweep the issue under the carpet and bury it under a change-log with language that heavily downplays the severity (e.g. "CVE - A buffer overflow could cause an application window behind the lockscreen to retain focus". Posting it on Twitter, however, draws attention to Apple's waning security practices and how such glaring holes manage to slip past their peer review. It sparks public outrage, and may serve as a wake-up call to the company.
Fishkins 9y ago
People post on twitter because it actually gets a quick response. According to Lemi Orhan Ergin, the root password bug had been reported to directly to Apple five days before his tweet, but there was no response/fix. Then he tweeted about it, and it was fixed the next day. https://medium.com/@lemiorhan/the-story-behind-anyone-can-login-as-root-tweet-33731b5ded71 https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo...
deleted 9y ago
[deleted]

by eamann 9y ago

Apple has a bug bounty program where they'll legitimately pay you to report bugs directly to them. What's with everyone reporting them to Twitter instead and forgoing the extra cash?

zitterbewegung 9y ago

Submitting a bug bounty takes time. Also, informing people of security issues can be a virtue which is its own reward.

gcb0 9y ago

the bounties are low. and registering to those things require some loss of anonymity before you do get paid. those are users dogfooding a product they paid for. and probably well off already, so the twitter bragging rigths is more valuable than the loss of anonymity + $500.

deleted 9y ago

[deleted]

bpicolo 9y ago

This doesn't seem like it would qualify under their categories. Not to mention, their bug bounty program info is nowhere to be found. I see tech sites reporting that they offer one but nothing on any apple site.

AdmiralAsshat 9y ago

There's a case to be made for public shaming, sometimes. You're leaving it up to Apple to decide whether they want to pay you or not; they might deny the bounty for some reason, while still fixing the bug. Now you get nothing, in addition to having given Apple time to sweep the issue under the carpet and bury it under a change-log with language that heavily downplays the severity (e.g. "CVE - A buffer overflow could cause an application window behind the lockscreen to retain focus". Posting it on Twitter, however, draws attention to Apple's waning security practices and how such glaring holes manage to slip past their peer review. It sparks public outrage, and may serve as a wake-up call to the company.

Fishkins 9y ago

People post on twitter because it actually gets a quick response. According to Lemi Orhan Ergin, the root password bug had been reported to directly to Apple five days before his tweet, but there was no response/fix. Then he tweeted about it, and it was fixed the next day. https://medium.com/@lemiorhan/the-story-behind-anyone-can-login-as-root-tweet-33731b5ded71 https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo...

deleted 9y ago

[deleted]