3 ms·

Agreed. People talking in the top-rated comments of this thread seem to think 1M is a lot of money for a vulnerability that could cost Apple lifetime customer v

by devin 7y ago

Agreed. People talking in the top-rated comments of this thread seem to think 1M is a lot of money for a vulnerability that could cost Apple lifetime customer value 10-100x the amount they’re offering in bounty.

charlesdm 7y ago
So the question is, assuming you have a valid exploit, could you not convince Apple to pay more than $1m? If you found an unfound gaping crater of an exploit somewhere -- how much would that be worth to them? Likely a lot more than $1m. I'm sure you could negotiate that number up, a lot.
- selectodude 7y ago
  The problem is that technically finding the exploit at all is in violation of the CFAA. Once you approach Apple with the exploit, you're then skating on their goodwill. Trying to play hardball probably won't go well for you.
- Cthulhu_ 7y ago
  Well how would you otherwise monetize the exploit? You could sell it on the black market, but I doubt you'd be able to make 1M off of it. Then again I don't know the black market so you could? But bug bounties like this are competing with the shadier markets. I suspect they found out the shady companies are offering more than their existing bug bounty program did.
- lifeisstillgood 7y ago
  Quite simply if you have your name on apple.com that says they paid you $1m under this program you just walk into any VC office in SF or Tel Aviv and say "how much have you got?" As Warren Buffet says there is plenty of money to be made in the centre
tptacek 7y ago
This is silly. Apple is going to have bugs almost no matter what they do, as will Google and Microsoft. It makes sense to invest way over the top if you can kill bug classes outright --- and Apple does this, too. For example, people that were doing DMA hardware attacks against macOS a couple years ago are now on Apple's payroll, designing hardware to defend against those attacks. That's a meaningful serious investment in defense. Rewriting their kernel in a memory safe language would be another example (one they haven't done yet). Massively outbidding the current spot price for a bug doesn't accomplish anything like that. Think about who they're really bidding against. They can drive the price of bugs way up, and they are doing that gradually, but there will still be a price and people selling them. The important thing they're doing on this is making unlocked devices available for researchers, and lowering the bar for research for people who would never sell to brokers.
- devin 7y ago
  I took the downvote, and I agree with everything you've said here. Thanks for your reply.

by devin 7y ago

charlesdm 7y ago

So the question is, assuming you have a valid exploit, could you not convince Apple to pay more than $1m? If you found an unfound gaping crater of an exploit somewhere -- how much would that be worth to them? Likely a lot more than $1m. I'm sure you could negotiate that number up, a lot.

selectodude 7y ago
The problem is that technically finding the exploit at all is in violation of the CFAA. Once you approach Apple with the exploit, you're then skating on their goodwill. Trying to play hardball probably won't go well for you.
Cthulhu_ 7y ago
Well how would you otherwise monetize the exploit? You could sell it on the black market, but I doubt you'd be able to make 1M off of it. Then again I don't know the black market so you could? But bug bounties like this are competing with the shadier markets. I suspect they found out the shady companies are offering more than their existing bug bounty program did.
lifeisstillgood 7y ago
Quite simply if you have your name on apple.com that says they paid you $1m under this program you just walk into any VC office in SF or Tel Aviv and say "how much have you got?" As Warren Buffet says there is plenty of money to be made in the centre

tptacek 7y ago

This is silly. Apple is going to have bugs almost no matter what they do, as will Google and Microsoft. It makes sense to invest way over the top if you can kill bug classes outright --- and Apple does this, too. For example, people that were doing DMA hardware attacks against macOS a couple years ago are now on Apple's payroll, designing hardware to defend against those attacks. That's a meaningful serious investment in defense. Rewriting their kernel in a memory safe language would be another example (one they haven't done yet). Massively outbidding the current spot price for a bug doesn't accomplish anything like that. Think about who they're really bidding against. They can drive the price of bugs way up, and they are doing that gradually, but there will still be a price and people selling them. The important thing they're doing on this is making unlocked devices available for researchers, and lowering the bar for research for people who would never sell to brokers.

devin 7y ago
I took the downvote, and I agree with everything you've said here. Thanks for your reply.