4 ms·

> 2021–03–30: Bug Bounty is still being evaluated

by lehi 6y ago

marshmallow_12 6y ago
If Apple are actually serious, why are they taking so long to give the bounty? It's sounds like madness to me.
- stephc_int13 6y ago
  This is clearly what triggered the post. Work was done but not paid. Shitty business on Apple side...
- Hnrobert42 6y ago
  Those who fix the bug and those who issue payment are likely in two different groups with two different sets of motivators. Not excusing but explaining.
MuffinFlavored 6y ago
The company has billions of dollars. I don't think a $50k-$100k bug bounty payout for them is a big deal. Even $1m wouldn't be a big deal to them.
- adolph 6y ago
  A company sufficiently large enough for such an amount to not be a big deal will have a money disbursal process nobody understands enough to make a one time transaction of that size in a reasonable amount of time.
  - cj 6y ago
    Finance can always be subverted by management, but it has to be a priority.
  - eyelidlessness 6y ago
    Maybe a company so large it can’t track its own finances is too large to be responsible for its obligations and should be held to standards at least as strict as its less capable business and human peers. And I’m an Apple fan to be clear. But their wealth is the opposite of an excuse.
    - fractionalhare 6y ago
      That's not an excuse. It's just a blunt explanation. Out of the ordinary processes can only proceed so quickly in the presence of massive bureaucracy.
    - adolph 6y ago
      It isn’t that finances aren’t tracked. They are tracked and audited and the audits are audited and there are many safeguards in place so that money doesn’t leak out and the knowledge for that operation is specialized, so much so that entire departments handle only part of the process and can’t just talk to one another due to the “segregation of duties” the auditors want. A company that decided to incentivize bug bounty like Google got support for the program on high and all the wheels of the org went to work to create policy, procedure, forms, auditor review, SARBOX compliance, etc and payouts will move like any other invoice. A company where some mid rank sees a need for such a program but doesn’t get full organizational alignment will be stuck with a pre-broken unreliable process.
      - deleted 6y ago
        [deleted]
      - eyelidlessness 6y ago
        That's still an organization that's too large or mismanaged to be trusted. We trust people who are capricious with their personal finances far less. A large organization with wealth impossible to humans but systems failing them and everyone else who depends on it... is a large corporation with wealth that has no excuse for not solving it.
- IncRnd 6y ago
  The value of a bug isn't proportional to how much money the company has.
  - KirillPanov 6y ago
    Why not? The potential damage certainly is proportional.
    - fractionalhare 6y ago
      You state this confidently but I don't see why it's true a priori. I don't see a strong correlation between Apple's cash on hand, assets or market cap and the severity of a zero day in Mail.app. The better comparison is active users, weighted according to how many apply automatic updates. The vulnerability half-life probably isn't as devastating as you might think it is since Apple has centralized control to push out updates, limited only by users deliberately not installing them. I would consider a vulnerability in OpenSSH to be far more economically devastating, and there isn't even a company with a market cap behind that software.
      - threatofrain 6y ago
        Then I'm sure you can easily see why Apple having money matters. openssh users may be damaged and yet there isn't an apparatus in place to reward those who can provide value. What a shame, but who is confused? Who is wondering why Patreon and a blog post isn't sufficient to facilitate value transfer in metaphorical openssh scenarios?
- my123 6y ago
  Your estimates of bug bounty money are orders of magnitude off. Guess how much Microsoft pays for breaking the Windows Secure Boot implementation? $9k.

> 2021–03–30: Bug Bounty is still being evaluated

by lehi 6y ago

> 2021–03–30: Bug Bounty is still being evaluated

marshmallow_12 6y ago

If Apple are actually serious, why are they taking so long to give the bounty? It's sounds like madness to me.

stephc_int13 6y ago
This is clearly what triggered the post. Work was done but not paid. Shitty business on Apple side...
Hnrobert42 6y ago
Those who fix the bug and those who issue payment are likely in two different groups with two different sets of motivators. Not excusing but explaining.

MuffinFlavored 6y ago

The company has billions of dollars. I don't think a $50k-$100k bug bounty payout for them is a big deal. Even $1m wouldn't be a big deal to them.

adolph 6y ago
A company sufficiently large enough for such an amount to not be a big deal will have a money disbursal process nobody understands enough to make a one time transaction of that size in a reasonable amount of time.
- cj 6y ago
  Finance can always be subverted by management, but it has to be a priority.
- eyelidlessness 6y ago
  Maybe a company so large it can’t track its own finances is too large to be responsible for its obligations and should be held to standards at least as strict as its less capable business and human peers. And I’m an Apple fan to be clear. But their wealth is the opposite of an excuse.
  - fractionalhare 6y ago
    That's not an excuse. It's just a blunt explanation. Out of the ordinary processes can only proceed so quickly in the presence of massive bureaucracy.
  - adolph 6y ago
    It isn’t that finances aren’t tracked. They are tracked and audited and the audits are audited and there are many safeguards in place so that money doesn’t leak out and the knowledge for that operation is specialized, so much so that entire departments handle only part of the process and can’t just talk to one another due to the “segregation of duties” the auditors want. A company that decided to incentivize bug bounty like Google got support for the program on high and all the wheels of the org went to work to create policy, procedure, forms, auditor review, SARBOX compliance, etc and payouts will move like any other invoice. A company where some mid rank sees a need for such a program but doesn’t get full organizational alignment will be stuck with a pre-broken unreliable process.
    - deleted 6y ago
      [deleted]
    - eyelidlessness 6y ago
      That's still an organization that's too large or mismanaged to be trusted. We trust people who are capricious with their personal finances far less. A large organization with wealth impossible to humans but systems failing them and everyone else who depends on it... is a large corporation with wealth that has no excuse for not solving it.
IncRnd 6y ago
The value of a bug isn't proportional to how much money the company has.
- KirillPanov 6y ago
  Why not? The potential damage certainly is proportional.
  - fractionalhare 6y ago
    You state this confidently but I don't see why it's true a priori. I don't see a strong correlation between Apple's cash on hand, assets or market cap and the severity of a zero day in Mail.app. The better comparison is active users, weighted according to how many apply automatic updates. The vulnerability half-life probably isn't as devastating as you might think it is since Apple has centralized control to push out updates, limited only by users deliberately not installing them. I would consider a vulnerability in OpenSSH to be far more economically devastating, and there isn't even a company with a market cap behind that software.
    - threatofrain 6y ago
      Then I'm sure you can easily see why Apple having money matters. openssh users may be damaged and yet there isn't an apparatus in place to reward those who can provide value. What a shame, but who is confused? Who is wondering why Patreon and a blog post isn't sufficient to facilitate value transfer in metaphorical openssh scenarios?
my123 6y ago
Your estimates of bug bounty money are orders of magnitude off. Guess how much Microsoft pays for breaking the Windows Secure Boot implementation? $9k.