3 ms·

In fact, I have given them technical details as to what the capabilities are and the affected macOS versions. I refuse to submit all of my research without them

In fact, I have given them technical details as to what the capabilities are and the affected macOS versions. I refuse to submit all of my research without them telling me roughly what the bounty ranges are for the vulnerabilities in the same class/equivalent impact. I've done many bounty programs in the past. Companies will always choose to pay nothing or close to nothing when it is favorable to them. Apple refuses to share what the bounty ranges are given technical information about it, and asked me to submit the entirety of my research without having any idea of what the compensation may be. So they made it impossible for me and perhaps many others to help improve the security of their OS ethically. For every 1 company that pays you in bug bounties, 10 don't. If you're a security researcher, you can't afford the possibility of getting nothing for months of research.

easton 6y ago
https://developer.apple.com/security-bounty/payouts/ https://developer.apple.com/security-bounty/payouts/ It's somewhere between $5,000 and these numbers (as $5,000 is the minimum).
- netsec_burn 6y ago
  $5,000 is the minimum for all categories. I have been unsuccessful at confirming with Apple that a local privilege escalation (LPE) to root is in any one of those categories, even though it's a widely understood type of vulnerability. So I've been trying to get their response on a category or at least have some frame of reference so I can have a reasonable expectation of what the ranges are. That is what Apple will not provide.
zepto 6y ago
> For every 1 company that pays you in bug bounties, 10 don't. Do you have reason to believe that Apple doesn’t pay, or are you basing this on other companies behavior?
- netsec_burn 6y ago
  A bit of both. I've read some articles about Apple's bounty program from people who were less than thrilled with it, and Apple went back and revised the bounty payouts when it ended up being bad PR/in the news. In the bug bounty programs I've done, I found nothing but P1 vulnerabilities (LPE, RCE, SQLi, LFI). The payouts have always been far below minimum wage, which gave me perspective on how much I could have made working in fast food instead. I have no reason to believe Apple will be more fair to researchers based on their track record, and their unwillingness to talk about it doesn't inspire any confidence.
  - zepto 6y ago
    Seems like an interesting dilemma for both you an Apple. I’m sure they get a bunch of bullshit and scams from people trying to sell them exploits, so the distrust is mutual. This does represent a trust issue in the industry, but I don’t see how it demonstrates that they ‘Don’t care about security’.

easton 6y ago

https://developer.apple.com/security-bounty/payouts/ https://developer.apple.com/security-bounty/payouts/ It's somewhere between $5,000 and these numbers (as $5,000 is the minimum).

netsec_burn 6y ago
$5,000 is the minimum for all categories. I have been unsuccessful at confirming with Apple that a local privilege escalation (LPE) to root is in any one of those categories, even though it's a widely understood type of vulnerability. So I've been trying to get their response on a category or at least have some frame of reference so I can have a reasonable expectation of what the ranges are. That is what Apple will not provide.

zepto 6y ago

> For every 1 company that pays you in bug bounties, 10 don't. Do you have reason to believe that Apple doesn’t pay, or are you basing this on other companies behavior?

netsec_burn 6y ago
A bit of both. I've read some articles about Apple's bounty program from people who were less than thrilled with it, and Apple went back and revised the bounty payouts when it ended up being bad PR/in the news. In the bug bounty programs I've done, I found nothing but P1 vulnerabilities (LPE, RCE, SQLi, LFI). The payouts have always been far below minimum wage, which gave me perspective on how much I could have made working in fast food instead. I have no reason to believe Apple will be more fair to researchers based on their track record, and their unwillingness to talk about it doesn't inspire any confidence.
- zepto 6y ago
  Seems like an interesting dilemma for both you an Apple. I’m sure they get a bunch of bullshit and scams from people trying to sell them exploits, so the distrust is mutual. This does represent a trust issue in the industry, but I don’t see how it demonstrates that they ‘Don’t care about security’.