6 ms·

The 4 exploits they got paid for don't seem like the biggest ones though. I would expect Apple to pay $500k - $1M for this session in the end, and it would be

by amenod 6y ago

The 4 exploits they got paid for don't seem like the biggest ones though. I would expect Apple to pay $500k - $1M for this session in the end, and it would be in the best interest of all parties if this happened. Apple would encourage responsible disclosure (and attract more white-hat bug hunters) this way. The amount of vulnerabilities found is a proof by itself that team work does pay off, if the team is strong. Also, this is a drop in the bucket for Apple. It would probably cost them much more to have them on the payroll for the same amount of time.

appleflaxen 6y ago
10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k
- phonebucket 6y ago
  > 10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k To my mind, this team deserves a higher salary than typical Silicon Valley programmers for this work.
  - deleted 6y ago
    [deleted]
  - appleflaxen 6y ago
    Agree; these people are incredibly skilled. The conclusion is the same: they are underpaid by a factor of approximately 4+
  - ska 6y ago
    FWIW Typical SV programmers don't make anything like 200k/yr, so they are already above that range even if there aren't more payouts...
tptacek 6y ago
Where did you come up with that number? $500k is much more than a sitewide external app pentest of comparable scope would cost Apple, by an integer multiple. The bugs here are good, but they're not "bug bounty black swan" good; they're what you'd expect from a sitewide pentest. I agree Apple got a great deal here (that's the point of bounties, and anyone who thinks they're a bad deal for strong researchers is... right). But I'm always going to point out that HN has weird misconceptions about the economics of this stuff.
- saagarjha 6y ago
  > $500k is much more than a sitewide external app pentest of comparable scope would cost Apple, by an integer multiple. By a team of four experienced security researchers working for multiple months?
  - TheRealPomax 6y ago
    A classic false comparison: the four experienced security researchers working for multiple months covers 55 issues, not "that one issue". If we're cherry picking a single one, the associated involvement and timeframe drops dramatically, to something much closer to one or two people, tops, over the course of just a few days, tops. That's something a pentesting team can absolutely achieve for far less than $500,000 over the course of a few days, too.
    - saagarjha 6y ago
      I’m unsure what your point is? I see dozens of different issues listed in the post, on different endpoints, all of which presumably took time to find. When they said they had a team of multiple people work for months on this, I am unsure why you think they haven’t spent their time as efficiently as “a pentesting team”. Actually, I’ll be stronger: looking through the list of things they discovered, it seems like they were absolutely churning out vulnerabilities for the entire period. A real team would have certainly cost much more than what they’ve currently been paid.
      - 6y ago

by amenod 6y ago

appleflaxen 6y ago

10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k

phonebucket 6y ago
> 10 person months would be 10/12ths of a programmer salary i Silicon Valley, which would probably be around $200k To my mind, this team deserves a higher salary than typical Silicon Valley programmers for this work.
- deleted 6y ago
  [deleted]
- appleflaxen 6y ago
  Agree; these people are incredibly skilled. The conclusion is the same: they are underpaid by a factor of approximately 4+
- ska 6y ago
  FWIW Typical SV programmers don't make anything like 200k/yr, so they are already above that range even if there aren't more payouts...

tptacek 6y ago

Where did you come up with that number? $500k is much more than a sitewide external app pentest of comparable scope would cost Apple, by an integer multiple. The bugs here are good, but they're not "bug bounty black swan" good; they're what you'd expect from a sitewide pentest. I agree Apple got a great deal here (that's the point of bounties, and anyone who thinks they're a bad deal for strong researchers is... right). But I'm always going to point out that HN has weird misconceptions about the economics of this stuff.

saagarjha 6y ago
> $500k is much more than a sitewide external app pentest of comparable scope would cost Apple, by an integer multiple. By a team of four experienced security researchers working for multiple months?
- TheRealPomax 6y ago
  A classic false comparison: the four experienced security researchers working for multiple months covers 55 issues, not "that one issue". If we're cherry picking a single one, the associated involvement and timeframe drops dramatically, to something much closer to one or two people, tops, over the course of just a few days, tops. That's something a pentesting team can absolutely achieve for far less than $500,000 over the course of a few days, too.
  - saagarjha 6y ago
    I’m unsure what your point is? I see dozens of different issues listed in the post, on different endpoints, all of which presumably took time to find. When they said they had a team of multiple people work for months on this, I am unsure why you think they haven’t spent their time as efficiently as “a pentesting team”. Actually, I’ll be stronger: looking through the list of things they discovered, it seems like they were absolutely churning out vulnerabilities for the entire period. A real team would have certainly cost much more than what they’ve currently been paid.
    - 6y ago