3 ms·
I'm not even claiming the vulnerability is serious. But when there's a bug bounty involved, the question is whether the vendor is ever going to pay, or the vend
by _qulr 6y ago
I'm not even claiming the vulnerability is serious. But when there's a bug bounty involved, the question is whether the vendor is ever going to pay, or the vendor is just leading the bug reporter on to keep it quiet for as long as possible.
- _qulr 6y agoApple doesn't pay a bounty until after they release a fix. So if Apple decided to de-prioritize a bug, you never get paid. But Apple doesn't tell if you they've de-prioritized a bug, they just want you to remain silent forever, and they say "We're still investigating."
- searchableguy 6y agoI don't understand how big companies are always penny-pinchers in this area. Anyone got a glue?
- Ansil849 6y agoMy armchair theory is that there is a bit of hubris involved: in-house developers are hesitant to admit they've been 'bested' by a stranger on the internet, and so downplay or even just have blinders on against recognizing in the first place the severity of the issue. Though to be far, I think the flipside is also at times true - where the independent security researcher believes the anthill they've found is a mountain.