13 ms·
Apple to contribute to U.S. teen's education for spotting FaceTime bug
- mikenew 8y ago> "In addition to addressing the bug that was reported, our team conducted a thorough security audit of the FaceTime service..." Why would they have not done this in the first place? Apple has more money than they know what to do with, why not have teams of people banging away on this stuff? The actual exploit was incredibly simple.
- eridius 8y agoThey probably did do this in the first place. But products change over time, so they need to keep doing them.
- duxup 8y agoI assume they do that sort of thing, but something was missed. So you find out why you missed it, and do it again to look for anything else that may have been missed the same way.
- czhiddy 8y agoWhat makes you think this was the first audit? Shipping a bug doesn't imply that zero QA was done.
- chrisseaton 8y agoDoes offering to contribute to someone's education sound to anyone else like they're criticising his current level of education? Seems like an insult? Like 'we'll pay for you to get a better education so next time you'll know how to speak to us correctly.' Why don't they just give him cash compensation if they want to apologise?
- vinceguidry 8y agoIt sounded to me like they're offering to contribute to an already-existing college fund or start one.
- chrisseaton 8y agoRight... but why that? Do they think there's a problem with his education specifically? Why not give him cash and let him put it in an education fund, or a pension fund, or whatever he wants? Why say 'and you'll want to use this to increase your education'? Like buying him a voucher for a facelift.
- vinceguidry 8y agoI don't think any parents or child is going to look that gift horse in the mouth.
- macintux 8y agoI believe he's receiving cash separately from the college fund. A college fund is a common way to acknowledge that a teenager often isn't the best judge of how to spend an influx of cash. Heck, if all of my employee bonuses over the years had been added to my retirement fund instead of my checking account, I'd be in much better shape.
- simongr3dal 8y agoI do not think anyone offering to contribute to a tuition fund are trying to insult the person. I can also imagine that putting the money in a fund have a lot of tax related benefits for both the persons giving and recieving the fund compared to paying it out in cash.
- joemi 8y agoThe US values education quite a bit (I suspect other places do too, but I can only speak for US experience), and there's a long history of rewarding children with educational funds for all kinds of things. This is very commonplace. As to why it's commonplace, well, if the family can afford to send the kid to college, then this is basically the same as giving them cash, since the family now gets to do what they want with the money they would have spent on his college. And if they couldn't afford to send him to college, now they can (or now they have a bit more help with it, depending on how much money was given). It looks good for the company too, since no one (except possibly you) thinks giving a kid an educational fund is a bad thing. Finally, by having such an educational stipulation, it hopefully prevents the parents (or legal guardians) from spending or wasting it on other things so that the kid ultimately reaps the benefits, which I think is prudent.
- dx420 8y agoSo a College fund or a Scholarship is an insult?
- chrisseaton 8y agoWhy not just the cash? An apology but you have to spend it how Apple wants? What's up with that?
- setquk 8y agoWhat if he buys a meth lab with it?
- Eliezer 8y agoWhat if Apple buys a meth lab with it? You’ve just deployed a fully general argument against the existence of money.
- setquk 8y agoI think I should use /s in here in future.
- blattimwind 8y agoWhat if he turns out to be the next Hitler?
- bertil 8y agoThey don't want to set a precedent of people blackmailing with a bug like rumours say he tried. The bounty program sets a price an avoid exploitation on both sides. Respecting that was more important. Paying a scholarship allows Apple to send a valuable transfer but no cash, rewarding the discovery without setting a precedent.
- Someone1234 8y ago> They don't want to set a precedent of people blackmailing with a bug like rumours say he tried. You're creating rumors, not reporting them. You can read the letter they sent to Apple. That wasn't even the first attempt at contact and all they asked about is if there were any bug bounties available. Nobody tried to blackmail anyone by simply asking if the bug may be eligible for a bounty.
- JustSomeNobody 8y agoWhy would it? That's just ... reading something into this that isn't there. The child is what, 14? You're not going to just drop a bucket o' cash in his lap. They probably talked to his mom and worked this out. Edit: Contributing to a minor's education is not uncommon in situations like this.
- gdubs 8y agoWell, it says they’ll “compensate [the family] and make an additional contribution [to his education fund]”, so it sounds like they’re doing both.
- CGamesPlay 8y agoThere are laws around the ways in which you can compensate minors. This may be the most reasonable way to pay the kid. That said, I assume the decision to make it an educational grant was not made without consultation with the family.
- username3 8y agoSpotting bugs pay more than bug bounties.
- bredren 8y agoHow so? Radar reports don't garner any payouts, do you mean with other companies?
- retrac98 8y agoGood PR move.
- duxup 8y agoNice. Still should have responded to them faster. Someone at Apple just dropped the ball when they got the report.
- Someone1234 8y agoI don't think it is any specific "someone." I think Apple's policies/procedures itself are more at fault. The fact that there's no way clear route to submitting security issues if you aren't a registered developer is problematic.
- duxup 8y agoOh man that's terrible. I've worked with folks who field security reports full time... you gotta have someone who can work with people and respond. It helps buy time while you fix things... / good PR.
- thisisweirdok 8y agoSeriously. They'd get a ton of bad reports like everyone with a bug bounty program, but Apple isn't exactly running lean on resources.
- icodemuch 8y agoFeels like the headline here should be related to bug itself, the amount of privacy it violated, and how long it took Apple to fix it! Clearly a good PR move for Apple.
- CGamesPlay 8y ago[deleted]
- murderfs 8y agoWhy do you expect some random member of the public to obey an arbitrary rule from the infosec community that they don't even all agree on?
- CGamesPlay 8y agoOh I don't. I expect Apple to hold their bug reporters to those standards, though, so it's interesting to see that they are giving a "bounty" to this "irresponsible disclosure".
- pfg 8y agoHow was the disclosure irresponsible? AIUI, multiple attempts were made to report the bug. It went viral a couple of days later on social media. I'm not aware of a link between those two events.
- simion314 8y agoDo you know how difficult it is to get into a bounty program?
- GranPC 8y agoHuh? Group calls were not a new feature, and the teen's mother made several attempts to disclose it privately to Apple, including registering for a developer account and submitting a bug from there. I'm pretty sure that's as close as "responsible disclosure" as you can get.
- argd678 8y agoI’m glad to see more attention from law makers over data security, many companies have shown little interest in correcting or preventing issues long enough.
- eiji 8y agoOnly in the land of philanthropy is such a headline a thing, or even a PR move. So instead of giving the guardian of said teenager 200k to do with as they/he/she pleases in the interest of the child, you set up a education funding scheme? But when the government does it, it's what?
- mac01021 8y ago> when the government does it, it's what? Unremarkable and not newsworthy?
- bairrd 8y agoOr it's news because funding education is bad and it's that vile socialism thing Obama was doing!
- drewmol 8y agoPolitely: That type of argument is unlikely to be made by users on this forum, so a sarcastic rhetorical response posted here only serves to create unwanted noise in this thread.
- bairrd 8y agoI get your point, but isn't the parent to my comment equally as sarcastic a rhetorical response?
- blattimwind 8y agoComponism
- reaperducer 8y agoSo instead of giving the guardian of said teenager 200k to do with as they/he/she pleases in the interest of the child A lot of people are jackwagons and will spend the money on whatever they want instead of their child's education. This way Apple gets to make sure it goes to the child's future. Source: Had to finance a big portion of college on MasterCard.
- bredren 8y agoHe also got a personal visit from an unnamed Apple executive.
- devin 8y agoSource?
- ascagnel_ 8y agohttps://www.cnbc.com/2019/02/04/-apple-could-pay-reward-to-grant-thompson-14-years-old-who-found-facetime-bug.html https://www.cnbc.com/2019/02/04/-apple-could-pay-reward-to-g...
- deleted 8y ago[deleted]
- sundvor 8y agoNice. Bit of a side point, but I feel that we should all give a shout out to the mum who clearly was the power broker for this to happen. She did a great job navigating the maze that was Apple's bug reporting pathways.
- bredren 8y agoI think so too. Focus is on the child but maybe the mom wants it that way.
- davesque 8y agoYou know, I'm happy on some level for that individual. It seems like a great stroke of fortune. On another level, it bothers me that there are such large institutions that can arbitrarily "bless" random people like a deity or something. I also can't help but look at this cynically as a largely self-interested PR grab by Apple that is not a real sacrifice on their part.
- mav3rick 8y agoWhat would work for you high standards ? If they do something it's Corporate BS. If they don't then they are same old Corp machine couldn't care less.
- elif 8y agoa transparent bug bounty system
- mav3rick 8y agoThe end result will be the same. You will call this a PR stunt.
- davesque 8y agoPerhaps. Although couldn't that just be because we're all so used to corporations having no real accountability and only occasionally deciding to make symbolic gestures as penance for their mistakes? You're probably right that, to many of us, they can't really do anything to make up for this. But that's not our problem. It's theirs.
- sjjshvuiajhz 8y agoI figure it’s the problem of whoever is feeling bad about it.
- mav3rick 8y agoThis is a very easy problem. If you feel this strongly stop buying their products. If you don't do that clearly you don't feel strongly enough. Blaming them when they do the right thing is just going to discourage them to do so in the future
- quenstionsasked 8y agoReported an iphone lock screen bug and received nothing. Thanks apple.
- Krasnol 8y agoNext time you need to scream louder. Lessons learned.
- mises 8y agoIf it's a serious bug, talk to a zero day broker.
- jtl999 8y agoI thought Zerodium (as an example) was only interested in RCE type vulnerabilities, although I could see others being of value as well.
- mises 8y agoZerodium might generally traffic in RCE because they're typically of the highest value. They would likely judge that to be of comparable value to some RCEs, if for no other reason because of the number of devices affected. Zerodium also isn't the only one out there.
- omegaworks 8y agoNot PR worthy. They took a look at your social media and determined that you were too outspoken.
- dsl 8y agoWhere did you report it, was it acknowledged, and was it ultimately fixed? Having ran a large bug bounty program before, I can tell you a few things could have happened here... * Issue was mis-triaged, or deemed to be very low impact - Maybe it depended on a very specific set of circumstances that was not expected to commonly occur. Usually these get silently routed to QA to investigate. * Issue was completely overlooked - Unlikely, but security@ is a ticket queue too. Sometimes a misclick happens, or a spam filter picks it up. For every valid report, you can get 100-1000 unrelated messages. * Issue was already known - Not good to silently ignore, but if it was already reported and in the pipeline, it probably got closed as a duplicate. Companies don't like to discuss vulnerabilities that are being actively fixed.
- bparsons 8y agoThey should just give him a large bug bounty.
- anth_anm 8y ago> Two key U.S. House of Representatives Democrats on Tuesday asked Apple Chief Executive Tim Cook to answer questions about the bug, saying they were “deeply troubled” over how long it took Apple to address the security flaw. honestly this just seems like a waste of time.
- dsl 8y agoAs a voter, this isn't very high on the list of things I'd like to see my representatives being "deeply troubled" about...
- rblion 8y agoApple is playing chess right now on the brand positioning game against Alphabet and Facebook. The most cynical people will dismiss it but most people will accept it as a gesture of goodwill.
- xparco 8y agoPublic relations for the proles