2 ms·
A bit of both. I've read some articles about Apple's bounty program from people who were less than thrilled with it, and Apple went back and revised the bounty
by netsec_burn 6y ago
A bit of both.
I've read some articles about Apple's bounty program from people who were less than thrilled with it, and Apple went back and revised the bounty payouts when it ended up being bad PR/in the news. In the bug bounty programs I've done, I found nothing but P1 vulnerabilities (LPE, RCE, SQLi, LFI). The payouts have always been far below minimum wage, which gave me perspective on how much I could have made working in fast food instead.
I have no reason to believe Apple will be more fair to researchers based on their track record, and their unwillingness to talk about it doesn't inspire any confidence.
- zepto 6y agoSeems like an interesting dilemma for both you an Apple. I’m sure they get a bunch of bullshit and scams from people trying to sell them exploits, so the distrust is mutual. This does represent a trust issue in the industry, but I don’t see how it demonstrates that they ‘Don’t care about security’.