5 ms·

By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting ac

By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.

lawnchair_larry 7y ago
No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.
- RandallBrown 7y ago
  You really think Apple is just going to gives special dev devices to random hackers from the Internet?
  - lawnchair_larry 7y ago
    I don’t think they will, I know they will. But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program. “Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash” https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple-iphone-hacker-meet-cupertino/#143026a473de https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple...
    - ksaj 7y ago
      That alone suggests that they are already acquainted with every one of the people they'll accept for the program? They might have a "loose" vetting process, but I doubt they have a lack of one.
    - mensetmanusman 7y ago
      Apple could use these devices to track the hackers...
      - saagarjha 7y ago
        Giving security researchers a “gift” that actually tracks them sounds like a really bad idea.
  - saagarjha 7y ago
    Note that random hackers from the internet already have access to these devices.
    - snazz 7y ago
      In the form of stolen red board or internal testing iPhones or something else?
      - saagarjha 7y ago
        Yeah, they're just buying dev-fused devices.
- vokep 7y ago
  The point is apple is likely to only aim for researchers for this program as the hackers could just resell most 0days, letting apple know about a small fraction to maintain reputation. It would make sense for apple to not allow hackers access to the program for this reason.
  - lawnchair_larry 7y ago
    I’m using researchers and hackers interchangeably here. It isn’t intended for academics or companies affiliated with Apple, that’s for sure.
  - azernik 7y ago
    In this context, "security researchers" is just the preferred job title that white-hat hackers put on their business cards. The ones who go for bug bounties are generally not paid by universities or large corporations to do that work.
- tecleandor 7y ago
  Don't know about ios, but university researchers have found quite a bunch of Intel vulnerabilities. If they get some special "developer" devices on their hands, they might find some funny things...
- grugq 7y ago
  The jailbreak community will not be getting these. They make more money continuing to sell to China than they will make selling to Apple.
  - lawnchair_larry 7y ago
    Some are already in the “vetted” bounty program. That doesn’t necessarily mean they will sell Apple the bugs though. How much do they make selling to China? Aside from the Chinese part of the jb scene, it’s kind of disheartening to know that the rest of them are selling that capability to a hostile adversary (if that’s true). I’m surprised the five eyes aren’t offering enough to keep them out of China’s hands.

By vetting applications, presumably. I would imagine it's mostly professors in well known universities and corporations closely affiliated with Apple getting access.

lawnchair_larry 7y ago

No, it’s hackers. The same folks who have been releasing jailbreaks. Professors haven’t been finding ios 0days. I’d say that the researchers have a pretty strong incentive not to screw around with Apple. It doesn’t matter anyway, because Apple patches the bug, thus killing its black market value completely.

RandallBrown 7y ago
You really think Apple is just going to gives special dev devices to random hackers from the Internet?
- lawnchair_larry 7y ago
  I don’t think they will, I know they will. But maybe it depends on how you define “hacker” and what you call “random”. I’m saying that folks in the jailbreaking scene are some of the primary targets for this. It wouldn’t be worth launching if the plan was to exclude them. Some are already part of Apple’s bounty program. “Apple Calls In Rock Star iPhone And Mac Hackers For Secret Bug Bounty Bash” https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple-iphone-hacker-meet-cupertino/#143026a473de https://www.forbes.com/sites/thomasbrewster/2016/09/28/apple...
  - ksaj 7y ago
    That alone suggests that they are already acquainted with every one of the people they'll accept for the program? They might have a "loose" vetting process, but I doubt they have a lack of one.
  - mensetmanusman 7y ago
    Apple could use these devices to track the hackers...
    - saagarjha 7y ago
      Giving security researchers a “gift” that actually tracks them sounds like a really bad idea.
- saagarjha 7y ago
  Note that random hackers from the internet already have access to these devices.
  - snazz 7y ago
    In the form of stolen red board or internal testing iPhones or something else?
    - saagarjha 7y ago
      Yeah, they're just buying dev-fused devices.
vokep 7y ago
The point is apple is likely to only aim for researchers for this program as the hackers could just resell most 0days, letting apple know about a small fraction to maintain reputation. It would make sense for apple to not allow hackers access to the program for this reason.
- lawnchair_larry 7y ago
  I’m using researchers and hackers interchangeably here. It isn’t intended for academics or companies affiliated with Apple, that’s for sure.
- azernik 7y ago
  In this context, "security researchers" is just the preferred job title that white-hat hackers put on their business cards. The ones who go for bug bounties are generally not paid by universities or large corporations to do that work.
tecleandor 7y ago
Don't know about ios, but university researchers have found quite a bunch of Intel vulnerabilities. If they get some special "developer" devices on their hands, they might find some funny things...
grugq 7y ago
The jailbreak community will not be getting these. They make more money continuing to sell to China than they will make selling to Apple.
- lawnchair_larry 7y ago
  Some are already in the “vetted” bounty program. That doesn’t necessarily mean they will sell Apple the bugs though. How much do they make selling to China? Aside from the Chinese part of the jb scene, it’s kind of disheartening to know that the rest of them are selling that capability to a hostile adversary (if that’s true). I’m surprised the five eyes aren’t offering enough to keep them out of China’s hands.