4 ms·

I read the terms of the SRD [1] to suggest if you get one, and use it, you aren't eligible for bounties on any bugs you find while using it. So, you are an en

I read the terms of the SRD [1] to suggest if you get one, and use it, you aren't eligible for bounties on any bugs you find while using it. So, you are an entirely unpaid Apple QA engineer. Knowledge is its own reward I guess. [1] "If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so."

xondono 6y ago
It doesn’t suggest that you aren’t eligible for bounties, but rather that you are not allowed to not disclose a vulnerability.
- usmannk 6y ago
  It certainly suggests this. Full bullet: If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so.
  - xondono 6y ago
    Maybe it’s me but what I read in that paragraph is: If you use the SRD, you are required to report any vulnerability. If you didn’t, you are not required but encouraged. It doesn’t say if you used it you aren’t eligible for reward
- wdb 6y ago
  It's probably hard to resist to use this SRD while trying to find a vulnerability if you have it such a device. If you use it for something you won't be eligible for the bounty.
vngzs 6y ago
The (and rewards) bit isn't saying that SRD users are ineligible for rewards! Rather, it's trying to encourage non-SRD users to report vulnerabilities they find. If Apple explicitly stated that SRD users are ineligible for bounties, I'd be pretty confident Apple has lost their minds, as the SRD devices would be completely worthless to vulnerability researchers - only serving to contractually restrict them, and offering no practical benefit. To show that "you aren't eligible for bounties on any bugs you find while using it" is false, let's break Apple's quote into two separate statements, and only consider things that are explicitly stated in them. First: > If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you use SRD in the process of discovering a vulnerability, you have to disclose it to the software authors. Got it. Second: > If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so." If you don't use SRD, Apple strongly encourages you to report the vulnerability. But they have no way to force it. I understand how a casual interpretation of those quotes could be seen to imply that SRD excludes you from bounties, but that's not what Apple is saying.
avianlyric 6y ago
Read a little further, the last bullet says > Vulnerabilities found with an SRD are automatically considered for reward through the Apple Security Bounty. I would say that pretty explicit about being eligible for bounties.
- saagarjha 6y ago
  (That bullet point did not exist before.)
  - deleted 6y ago
    [deleted]

xondono 6y ago

It doesn’t suggest that you aren’t eligible for bounties, but rather that you are not allowed to not disclose a vulnerability.

usmannk 6y ago
It certainly suggests this. Full bullet: If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so.
- xondono 6y ago
  Maybe it’s me but what I read in that paragraph is: If you use the SRD, you are required to report any vulnerability. If you didn’t, you are not required but encouraged. It doesn’t say if you used it you aren’t eligible for reward
wdb 6y ago
It's probably hard to resist to use this SRD while trying to find a vulnerability if you have it such a device. If you use it for something you won't be eligible for the bounty.

vngzs 6y ago

The (and rewards) bit isn't saying that SRD users are ineligible for rewards! Rather, it's trying to encourage non-SRD users to report vulnerabilities they find. If Apple explicitly stated that SRD users are ineligible for bounties, I'd be pretty confident Apple has lost their minds, as the SRD devices would be completely worthless to vulnerability researchers - only serving to contractually restrict them, and offering no practical benefit. To show that "you aren't eligible for bounties on any bugs you find while using it" is false, let's break Apple's quote into two separate statements, and only consider things that are explicitly stated in them. First: > If you use the SRD to find, test, validate, verify, or confirm a vulnerability, you must promptly report it to Apple and, if the bug is in third-party code, to the appropriate third party. If you use SRD in the process of discovering a vulnerability, you have to disclose it to the software authors. Got it. Second: > If you didn’t use the SRD for any aspect of your work with a vulnerability, Apple strongly encourages (and rewards, through the Apple Security Bounty) that you report the vulnerability, but you are not required to do so." If you don't use SRD, Apple strongly encourages you to report the vulnerability. But they have no way to force it. I understand how a casual interpretation of those quotes could be seen to imply that SRD excludes you from bounties, but that's not what Apple is saying.

avianlyric 6y ago

Read a little further, the last bullet says > Vulnerabilities found with an SRD are automatically considered for reward through the Apple Security Bounty. I would say that pretty explicit about being eligible for bounties.

saagarjha 6y ago
(That bullet point did not exist before.)
- deleted 6y ago
  [deleted]