12 ms·

July 6 - August 6 - September 6 -- that's 2 months elapsed, not three. Five people working for 2 months is 10 person-months. Apple paid them just under $52,000

by dsr_ 6y ago

July 6 - August 6 - September 6 -- that's 2 months elapsed, not three. Five people working for 2 months is 10 person-months. Apple paid them just under $52,000, none of which was guaranteed. They had to pay whatever taxes are appropriate for their jurisdictions. I'd say Apple got an amazing bargain.

perch56 6y ago
As of October 6th, 2020, the vast majority of these findings have been fixed and credited. 3 months as I think they added the extra month as part of the responsible disclosure and remediation phase.
w1ntermute 6y ago
If they actually did get paid so little, why did they do it? This seems like a terrible use of their time.
- culturestate 6y ago
  I'd wager they'll make substantially more money from the long tail of this blog post than from the bounties.
- atom-morgan 6y ago
  Many people undervalue their services.
- bredren 6y ago
  He does use the word fun twice in the opening.
- snowwrestler 6y ago
  Qualifying people for highly paid info security positions is shockingly broken right now. No one who knows what they are doing cares about credentials you can get from a training program or school, but they also complain constantly about how hard it is to find and hire qualified people. The result is: there is a lot of salary out there for people who can figure out how to get it. Developing exploits that are acknowledged by major targets--even if done freelance or as a hobby--is one of the few ways to gain lines on your resume that everyone in the security field will pay attention to.
  - londons_explore 6y ago
    It's the whole "you need to volunteer for a year before we'll hire you" hiring method typically seen in low paid positions in the arts, but this time for high paid infosec positions...
    - splitrocket 6y ago
      It's effectively a screen for skills that are very, very difficult to validate with credentials. Yes, it also is effectively a screen for people with the spare resources to invest in a career without getting paid for it.
    - snowwrestler 6y ago
      The art world might not be a bad comparison. In both security and art, established people with money are looking for new people who have the ability to make an impact. But the established folks don't know in advance what exactly that will be... if they did, they'd already be paying someone to do it. As a new person, there's no better way to demonstrate your ability to make an impact than to just do it.
  - notsuoh 6y ago
    I work at a company that has an infosec division and I don't know how we got so lucky with the people there. They're seriously legit low level kernel type programmers who seem to be able to reverse engineer anything given enough time and are able to seriously reason about what's going on in security. The types of people who speak at and headline at the largest security conferences, etc. Again, no idea how we got so lucky to have a great crew. I'm not an infosec person myself. But my experience is that upwards of 80% of the ones I interact with who aren't like the people I mentioned above are just hangers on because they like the group or being associated with "infosec" because it sounds cool or something. Maybe it's because you don't need to be an engineer to regurgitate OWASP vulnerabilities and tell people to use password managers, but perhaps that's enough to, after you look around the room of infosec people, feel like you're an "infosec person." To be clear, that stuff is important, but not anywhere close to sufficient. So a lot of applications for our roles come from these people, who just sit on twitter all day and retweet the Taylor Swift security person, but they're totally not technical and have done nothing of note other than write compliance plans. My hypothesis is that it's all this noise that makes hiring good infosec people difficult. If I'm hiring a kernel programmer or SRE I seem to get much more signal in my applications, but hire someone for security or infosec and there's too much noise from people like above.
- ponker 6y ago
  If you wanted to get hired as a bank robber, how would you do it? Gotta rob a few banks first.
- jcims 6y ago
  Bug bounties are not generally considered a good source of income. It's a way to hone your skills, gain experience, develop a bit of industry cachet and get paid a little in the process.
- tinus_hn 6y ago
  For one they did not only get the money but also the exposure that comes with anything Apple. A lot of people will probably want to hire these researchers.
- 14 6y ago
  It is impossible to quantify what is a good use of their time without knowing them. Also not everyone does things in the pursuit of money. I sell eggs and could easily ask 5$ a dozen with the demand I have. Instead I only ask 4$ and have lots of clients I only charge 2$ and some I just give eggs to when I have extra. These are people with no money or means. I don’t expect to ever get anything from these people but every once in a while ‘oh my car breaks down and guess who has the knowledge or tool I need the guy I have been giving eggs’. I know the world will eat you up and take all you have but I personally “invest” my time and effort into a few of the things I enjoy even if the reward is low. These researchers now have an excellent start to a resume which is always a good thing.
  - saagarjha 6y ago
    > I sell eggs Is this like an actual side business you run? Can you tell us more?
    - 14 6y ago
      Well after covid started and the stores ran out of a lot of food I decided to get some chickens again. I have had a maximum of 6 in the past but decided to increase the flock since 6 birds is pretty much the same effort as 30 birds. I now have 33 in total and at this point in their life get one egg a day. They average something like 300+ eggs a year. I have sold enough to buy an automatic egg washer and now mainly worry about selling enough to cover feed costs. I do it because chickens are very therapeutic and I find them relaxing to be around. I have young kids so they are also learning the value of food and can eat all the eggs they want. So I wouldn’t really call it much of a business it is more of a hobby that I reap little reward other then my eggs and to help out a few others near me. I think if I ramped up to a few hundred birds I could make a bit of money but at the small size it keeps me from getting overwhelmed with too much work and I can just share my harvest with those around me. I have learned that making money is nice but I also get a great deal reward from helping others in need.
Traster 6y ago
It now says: >Between the period of July 6th to October 6th They may have corrected it. Whilst $52k is cheap for 15 months of labour, that's as of October 4th. So it's not unreasonable for that number to go up significantly over time. It'll be interesting to see what their final total is. I don't know what Apple would value 15 months of highly skilled security consultants at, but I can't imagine it'd be below $200k, so Apple is likely still getting a good deal even if they pay out a lot more.
trollied 6y ago
They've only paid out on a small number of the reports so far though. There's time for more $ to roll in.
rvz 6y ago
Exactly. The amount of effort put into finding multiple critical - high vulnerabilities of a $1TN+ company and the result is $51k + taxes to possibly share between 5 hackers for 4 qualifying bugs for that bounty sounds like Apple took them for a cheap ride through their campus. Compared to 1 hacker, 1 month, JWT signature check failure = 100k from Apple [0]: [0] https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...
- amenod 6y ago
  The 4 exploits they got paid for don't seem like the biggest ones though. I would expect Apple to pay $500k - $1M for this session in the end, and it would be in the best interest of all parties if this happened. Apple would encourage responsible disclosure (and attract more white-hat bug hunters) this way. The amount of vulnerabilities found is a proof by itself that team work does pay off, if the team is strong. Also, this is a drop in the bucket for Apple. It would probably cost them much more to have them on the payroll for the same amount of time.
  - appleflaxen 6y ago
    10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k
    - phonebucket 6y ago
      > 10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k To my mind, this team deserves a higher salary than typical Silicon Valley programmers for this work.
      - deleted 6y ago
        [deleted]
      - appleflaxen 6y ago
        Agree; these people are incredibly skilled. The conclusion is the same: they are underpaid by a factor of approximately 4+
justplay 6y ago
i had expected that Appple might have paid a million to him.
isodev 6y ago
It doesn't sound like they were working on this 8h a day of every day.
- zekrioca 6y ago
  It is not about $/hour, it is about the knowledge they have learnt and that will help Apple protect against some bugs which would result in losses and other damages to consumers..
  - EpicEng 6y ago
    >It is not about $/hour It is when the thread kicked off by measuring how much they are being paid / man month...
EE84M3i 6y ago
You are making the false assumption that these people are working fulltime, which they are not. At least 3 of them have full time jobs.
- lostlogin 6y ago
  As full time job might not mean 40 hours per week during the pandemic. This is briefly mentioned in the article. “ This was originally meant to be a side project that we'd work on every once in a while, but with all of the extra free time with the pandemic we each ended up putting a few hundred hours into it.”
tuna-piano 6y ago
Something tells me the real money comes from future consulting contracts and that this PR will more than pay for itself. Just like how everyone on HN agrees writing a book isn't a great use of time besides what it allows you to put on your resume. Just because Apple got an amazing bargain doesn't mean the payout for them won't be great as well.
- ethanwillis 6y ago
  One problem is this puts a downward pressure on others who demand fair compensation for their labor. Not everyone wants to play a long game of "maybe i'll get paid in the future from the 'experience'" This is the professional equivalent of having interns do a bunch of real work and throwing them a pizza party.
  - mason240 6y ago
    This is very fair criticism for standard jobs like a regular software developer. For a role like this, where outsized skill of someone who is and needs to be elite should be rewarded with enormously outsized pay, I think this a good model.
    - ethanwillis 6y ago
      I think we're in agreement. But, I do find it wild that a group as decorated as this already can't even get compensation that is commensurate with their skill and experience without having to rely on intangible future benefits.
  - PragmaticPulp 6y ago
    Unfortunately, it doesn’t matter if other people don’t want to play the long game. This team does, they’re executing it well, and it will boost their careers as a result. Everything was done voluntarily by consenting professionals with the rules of the game outlined up front. Can’t really fault them for that.
    - 6y ago
moogleii 6y ago
> However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months. Annoying, but possibly more to come.
gorbachev 6y ago
That blog post alone is worth more than $52K in the long run.
strogonoff 6y ago
Getting an opportunity to write a case study could be worth a good discount!
TheRealPomax 6y ago
Everybody wins here. It's a bargain for Apple, because their ledgers deal with numbers that require the -illions suffixes, but it's ALSO $10k per person, which even after taxes is still a lot of money on top of their regular salary for anyone with bills to pay.
- intricatedetail 6y ago
  Good pentester costs typically $2000 per day. Given the amount of work they did, the return feels like a slap in the face. Certainly it won't encourage highly skilled people to hunt for security holes.
- dkonofalski 6y ago
  At least $10k per person since the total payouts are still coming in and haven't included any of the high or critical exploits so far.
king_panic 6y ago
If they really wanted money, they would have gone in a different direction. With their abilities, they could still go in that direction.
vayne 6y ago
The thing is not all RCEs are the same. Apple paid the right amount here.
rocho 6y ago
Off-by-one error, the irony! Jokes aside, I agree that the payout seems shockingly low.
Iv 6y ago
These are not equivalent propositions. There is an incredible amount of value in working outside of a big corporation and its management hierarchy. It is a Dog and the Wolf situation. The food is always better under the collar.
dkonofalski 6y ago
Apple hasn't paid them for the largest exploits yet. That $52k will likely blow-up to far more when Apple pays them so their work will end up being much more lucrative. Apple also pays in batches so they'll likely get a few more batches and some of those will be yuuuuuuuge!

by dsr_ 6y ago

perch56 6y ago

As of October 6th, 2020, the vast majority of these findings have been fixed and credited. 3 months as I think they added the extra month as part of the responsible disclosure and remediation phase.

w1ntermute 6y ago

If they actually did get paid so little, why did they do it? This seems like a terrible use of their time.

culturestate 6y ago
I'd wager they'll make substantially more money from the long tail of this blog post than from the bounties.
atom-morgan 6y ago
Many people undervalue their services.
bredren 6y ago
He does use the word fun twice in the opening.
snowwrestler 6y ago
Qualifying people for highly paid info security positions is shockingly broken right now. No one who knows what they are doing cares about credentials you can get from a training program or school, but they also complain constantly about how hard it is to find and hire qualified people. The result is: there is a lot of salary out there for people who can figure out how to get it. Developing exploits that are acknowledged by major targets--even if done freelance or as a hobby--is one of the few ways to gain lines on your resume that everyone in the security field will pay attention to.
- londons_explore 6y ago
  It's the whole "you need to volunteer for a year before we'll hire you" hiring method typically seen in low paid positions in the arts, but this time for high paid infosec positions...
  - splitrocket 6y ago
    It's effectively a screen for skills that are very, very difficult to validate with credentials. Yes, it also is effectively a screen for people with the spare resources to invest in a career without getting paid for it.
  - snowwrestler 6y ago
    The art world might not be a bad comparison. In both security and art, established people with money are looking for new people who have the ability to make an impact. But the established folks don't know in advance what exactly that will be... if they did, they'd already be paying someone to do it. As a new person, there's no better way to demonstrate your ability to make an impact than to just do it.
- notsuoh 6y ago
  I work at a company that has an infosec division and I don't know how we got so lucky with the people there. They're seriously legit low level kernel type programmers who seem to be able to reverse engineer anything given enough time and are able to seriously reason about what's going on in security. The types of people who speak at and headline at the largest security conferences, etc. Again, no idea how we got so lucky to have a great crew. I'm not an infosec person myself. But my experience is that upwards of 80% of the ones I interact with who aren't like the people I mentioned above are just hangers on because they like the group or being associated with "infosec" because it sounds cool or something. Maybe it's because you don't need to be an engineer to regurgitate OWASP vulnerabilities and tell people to use password managers, but perhaps that's enough to, after you look around the room of infosec people, feel like you're an "infosec person." To be clear, that stuff is important, but not anywhere close to sufficient. So a lot of applications for our roles come from these people, who just sit on twitter all day and retweet the Taylor Swift security person, but they're totally not technical and have done nothing of note other than write compliance plans. My hypothesis is that it's all this noise that makes hiring good infosec people difficult. If I'm hiring a kernel programmer or SRE I seem to get much more signal in my applications, but hire someone for security or infosec and there's too much noise from people like above.
ponker 6y ago
If you wanted to get hired as a bank robber, how would you do it? Gotta rob a few banks first.
jcims 6y ago
Bug bounties are not generally considered a good source of income. It's a way to hone your skills, gain experience, develop a bit of industry cachet and get paid a little in the process.
tinus_hn 6y ago
For one they did not only get the money but also the exposure that comes with anything Apple. A lot of people will probably want to hire these researchers.
14 6y ago
It is impossible to quantify what is a good use of their time without knowing them. Also not everyone does things in the pursuit of money. I sell eggs and could easily ask 5$ a dozen with the demand I have. Instead I only ask 4$ and have lots of clients I only charge 2$ and some I just give eggs to when I have extra. These are people with no money or means. I don’t expect to ever get anything from these people but every once in a while ‘oh my car breaks down and guess who has the knowledge or tool I need the guy I have been giving eggs’. I know the world will eat you up and take all you have but I personally “invest” my time and effort into a few of the things I enjoy even if the reward is low. These researchers now have an excellent start to a resume which is always a good thing.
- saagarjha 6y ago
  > I sell eggs Is this like an actual side business you run? Can you tell us more?
  - 14 6y ago
    Well after covid started and the stores ran out of a lot of food I decided to get some chickens again. I have had a maximum of 6 in the past but decided to increase the flock since 6 birds is pretty much the same effort as 30 birds. I now have 33 in total and at this point in their life get one egg a day. They average something like 300+ eggs a year. I have sold enough to buy an automatic egg washer and now mainly worry about selling enough to cover feed costs. I do it because chickens are very therapeutic and I find them relaxing to be around. I have young kids so they are also learning the value of food and can eat all the eggs they want. So I wouldn’t really call it much of a business it is more of a hobby that I reap little reward other then my eggs and to help out a few others near me. I think if I ramped up to a few hundred birds I could make a bit of money but at the small size it keeps me from getting overwhelmed with too much work and I can just share my harvest with those around me. I have learned that making money is nice but I also get a great deal reward from helping others in need.

Traster 6y ago

It now says: >Between the period of July 6th to October 6th They may have corrected it. Whilst $52k is cheap for 15 months of labour, that's as of October 4th. So it's not unreasonable for that number to go up significantly over time. It'll be interesting to see what their final total is. I don't know what Apple would value 15 months of highly skilled security consultants at, but I can't imagine it'd be below $200k, so Apple is likely still getting a good deal even if they pay out a lot more.

trollied 6y ago

They've only paid out on a small number of the reports so far though. There's time for more $ to roll in.

rvz 6y ago

Exactly. The amount of effort put into finding multiple critical - high vulnerabilities of a $1TN+ company and the result is $51k + taxes to possibly share between 5 hackers for 4 qualifying bugs for that bounty sounds like Apple took them for a cheap ride through their campus. Compared to 1 hacker, 1 month, JWT signature check failure = 100k from Apple [0]: [0] https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...

amenod 6y ago
The 4 exploits they got paid for don't seem like the biggest ones though. I would expect Apple to pay $500k - $1M for this session in the end, and it would be in the best interest of all parties if this happened. Apple would encourage responsible disclosure (and attract more white-hat bug hunters) this way. The amount of vulnerabilities found is a proof by itself that team work does pay off, if the team is strong. Also, this is a drop in the bucket for Apple. It would probably cost them much more to have them on the payroll for the same amount of time.
- appleflaxen 6y ago
  10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k
  - phonebucket 6y ago
    > 10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k To my mind, this team deserves a higher salary than typical Silicon Valley programmers for this work.
    - deleted 6y ago
      [deleted]
    - appleflaxen 6y ago
      Agree; these people are incredibly skilled. The conclusion is the same: they are underpaid by a factor of approximately 4+

justplay 6y ago

i had expected that Appple might have paid a million to him.

isodev 6y ago

It doesn't sound like they were working on this 8h a day of every day.

zekrioca 6y ago
It is not about $/hour, it is about the knowledge they have learnt and that will help Apple protect against some bugs which would result in losses and other damages to consumers..
- EpicEng 6y ago
  >It is not about $/hour It is when the thread kicked off by measuring how much they are being paid / man month...

EE84M3i 6y ago

You are making the false assumption that these people are working fulltime, which they are not. At least 3 of them have full time jobs.

lostlogin 6y ago
As full time job might not mean 40 hours per week during the pandemic. This is briefly mentioned in the article. “ This was originally meant to be a side project that we'd work on every once in a while, but with all of the extra free time with the pandemic we each ended up putting a few hundred hours into it.”

tuna-piano 6y ago

Something tells me the real money comes from future consulting contracts and that this PR will more than pay for itself. Just like how everyone on HN agrees writing a book isn't a great use of time besides what it allows you to put on your resume. Just because Apple got an amazing bargain doesn't mean the payout for them won't be great as well.

ethanwillis 6y ago
One problem is this puts a downward pressure on others who demand fair compensation for their labor. Not everyone wants to play a long game of "maybe i'll get paid in the future from the 'experience'" This is the professional equivalent of having interns do a bunch of real work and throwing them a pizza party.
- mason240 6y ago
  This is very fair criticism for standard jobs like a regular software developer. For a role like this, where outsized skill of someone who is and needs to be elite should be rewarded with enormously outsized pay, I think this a good model.
  - ethanwillis 6y ago
    I think we're in agreement. But, I do find it wild that a group as decorated as this already can't even get compensation that is commensurate with their skill and experience without having to rely on intangible future benefits.
- PragmaticPulp 6y ago
  Unfortunately, it doesn’t matter if other people don’t want to play the long game. This team does, they’re executing it well, and it will boost their careers as a result. Everything was done voluntarily by consenting professionals with the rules of the game outlined up front. Can’t really fault them for that.
  - 6y ago

moogleii 6y ago

> However, it appears that Apple does payments in batches and will likely pay for more of the issues in the following months. Annoying, but possibly more to come.

gorbachev 6y ago

That blog post alone is worth more than $52K in the long run.

strogonoff 6y ago

Getting an opportunity to write a case study could be worth a good discount!

TheRealPomax 6y ago

Everybody wins here. It's a bargain for Apple, because their ledgers deal with numbers that require the -illions suffixes, but it's ALSO $10k per person, which even after taxes is still a lot of money on top of their regular salary for anyone with bills to pay.

intricatedetail 6y ago
Good pentester costs typically $2000 per day. Given the amount of work they did, the return feels like a slap in the face. Certainly it won't encourage highly skilled people to hunt for security holes.
dkonofalski 6y ago
At least $10k per person since the total payouts are still coming in and haven't included any of the high or critical exploits so far.

king_panic 6y ago

If they really wanted money, they would have gone in a different direction. With their abilities, they could still go in that direction.

vayne 6y ago

The thing is not all RCEs are the same. Apple paid the right amount here.

rocho 6y ago

Off-by-one error, the irony! Jokes aside, I agree that the payout seems shockingly low.

Iv 6y ago

These are not equivalent propositions. There is an incredible amount of value in working outside of a big corporation and its management hierarchy. It is a Dog and the Wolf situation. The food is always better under the collar.

dkonofalski 6y ago

Apple hasn't paid them for the largest exploits yet. That $52k will likely blow-up to far more when Apple pays them so their work will end up being much more lucrative. Apple also pays in batches so they'll likely get a few more batches and some of those will be yuuuuuuuge!