6 ms·

It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn't paid out. Maybe a good business is bug escrow company.

by Zhenya 6y ago

hbbio 6y ago
zerodium
megablast 6y ago
Does it? It seems the priority should be fixing the issue.
- Zhenya 6y ago
  Do you think the finance department is pushing the changes?
- whimsicalism 6y ago
  Presumably not paying out has a chilling effect on bug identification by good guys.
- smoldesu 6y ago
  A considerably larger priority is identifying the issues before bad actors can take advantage of it.
spitfire 6y ago
Bug bounty factoring! From wikipedia: > Factoring is a financial transaction and a type of debtor finance in which a business sells its accounts receivable (i.e., invoices) to a third party (called a factor) at a discount.[1][2][3] A business will sometimes factor its receivable assets to meet its present and immediate cash needs.[4][5] Forfaiting is a factoring arrangement used in international trade finance by exporters who wish to sell their receivables to a forfaiter.[6] Factoring is commonly referred to as accounts receivable factoring, invoice factoring, and sometimes accounts receivable financing. Accounts receivable financing is a term more accurately used to describe a form of asset based lending against accounts receivable. The Commercial Finance Association is the leading trade association of the asset-based lending and factoring industries.[7]
- runeks 6y ago
  This sounds like discounting a Bill of Exchange. Although the Bill of Exchange is drawn only against the delivery of a physical good, so this may be the difference between the two. For example, let's say I own a sheep farm. I hire people to trim the sheep, and they produce a bunch of cotton. Without the Bill of Exchange, if I want to pay the people I've hired then I will need to ship this cotton to the spinner, who then ships the spun cotton to the weaver, who then ships the woven cotton to the clothier, who then makes clothes and sells it to a consumer. Only after this has happened can I pay my employees with the money of the paying consumer. With the Bill of Exchange, a bill is created when I deliver cotton to the spinner. This bill will require the spinner to pay me for the cotton delivered in e.g. three months. I can then take this bill to someone who trusts that the spinner will pay me in three months and ask them to buy the bill at a discount, such that they are paid in three months (when the bill expires). I can then use the proceeds from the sale of the bill to pay my employees immediately. And the buyer of the bill earns a bit of interest because he pays less for the bill than he is paid at maturity. [1] https://professorfekete.com/articles/AEFMonEcon101Lecture5.pdf https://professorfekete.com/articles/AEFMonEcon101Lecture5.p... [2] https://professorfekete.com/articles/AEFMonEcon101Lecture6.pdf https://professorfekete.com/articles/AEFMonEcon101Lecture6.p...
  - spockz 6y ago
    I think the general category this falls under is supply chain finance.
  - tonyarkles 6y ago
    Small nit: you get wool from sheep, not cotton :). Otherwise, that’s really interesting and I didn’t know that was a thing!
hnick 6y ago
Places like Bugcrowd act as a go-between but the company will have to be on there.
philosopher1234 6y ago
I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.
- saagarjha 6y ago
  Who does the verification?
  - adolph 6y ago
    NSA front company probably. They will do it for free so they can front-run the zero days.
  - GoblinSlayer 6y ago
    Apple's own subdivision :) An alternative is public offer when Apple promises to not release a fix without payment. If it's not a bug, no need for a fix.
- jonny_eh 6y ago
  That may be considered black-mail by some courts.
  - Itsdijital 6y ago
    I guess that's true. Whats the end state if Apple refuses to pay?
    - eyelidlessness 6y ago
      “It would be a shame if someone used this vulnerability”
    - albntomat0 6y ago
      Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.
willyt 6y ago
Did he phone them to check? I get a lot of fake invoices in my junk mail. I also know someone who lost £50k paying an invoice with bank details that had been tampered with by hackers. I hate phoning people but I always phone about invoices.

It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn't paid out. Maybe a good business is bug escrow company.

by Zhenya 6y ago

It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn't paid out. Maybe a good business is bug escrow company.

hbbio 6y ago

zerodium

megablast 6y ago

Does it? It seems the priority should be fixing the issue.

Zhenya 6y ago
Do you think the finance department is pushing the changes?
whimsicalism 6y ago
Presumably not paying out has a chilling effect on bug identification by good guys.
smoldesu 6y ago
A considerably larger priority is identifying the issues before bad actors can take advantage of it.

spitfire 6y ago

Bug bounty factoring! From wikipedia: > Factoring is a financial transaction and a type of debtor finance in which a business sells its accounts receivable (i.e., invoices) to a third party (called a factor) at a discount.[1][2][3] A business will sometimes factor its receivable assets to meet its present and immediate cash needs.[4][5] Forfaiting is a factoring arrangement used in international trade finance by exporters who wish to sell their receivables to a forfaiter.[6] Factoring is commonly referred to as accounts receivable factoring, invoice factoring, and sometimes accounts receivable financing. Accounts receivable financing is a term more accurately used to describe a form of asset based lending against accounts receivable. The Commercial Finance Association is the leading trade association of the asset-based lending and factoring industries.[7]

runeks 6y ago
This sounds like discounting a Bill of Exchange. Although the Bill of Exchange is drawn only against the delivery of a physical good, so this may be the difference between the two. For example, let's say I own a sheep farm. I hire people to trim the sheep, and they produce a bunch of cotton. Without the Bill of Exchange, if I want to pay the people I've hired then I will need to ship this cotton to the spinner, who then ships the spun cotton to the weaver, who then ships the woven cotton to the clothier, who then makes clothes and sells it to a consumer. Only after this has happened can I pay my employees with the money of the paying consumer. With the Bill of Exchange, a bill is created when I deliver cotton to the spinner. This bill will require the spinner to pay me for the cotton delivered in e.g. three months. I can then take this bill to someone who trusts that the spinner will pay me in three months and ask them to buy the bill at a discount, such that they are paid in three months (when the bill expires). I can then use the proceeds from the sale of the bill to pay my employees immediately. And the buyer of the bill earns a bit of interest because he pays less for the bill than he is paid at maturity. [1] https://professorfekete.com/articles/AEFMonEcon101Lecture5.pdf https://professorfekete.com/articles/AEFMonEcon101Lecture5.p... [2] https://professorfekete.com/articles/AEFMonEcon101Lecture6.pdf https://professorfekete.com/articles/AEFMonEcon101Lecture6.p...
- spockz 6y ago
  I think the general category this falls under is supply chain finance.
- tonyarkles 6y ago
  Small nit: you get wool from sheep, not cotton :). Otherwise, that’s really interesting and I didn’t know that was a thing!

hnick 6y ago

Places like Bugcrowd act as a go-between but the company will have to be on there.

philosopher1234 6y ago

I like this idea. 1. Company verifies the bug 2. Assigns it a price according to impact 3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access. Different bug markets can compete to correctly price bugs.

saagarjha 6y ago
Who does the verification?
- adolph 6y ago
  NSA front company probably. They will do it for free so they can front-run the zero days.
- GoblinSlayer 6y ago
  Apple's own subdivision :) An alternative is public offer when Apple promises to not release a fix without payment. If it's not a bug, no need for a fix.
jonny_eh 6y ago
That may be considered black-mail by some courts.
- Itsdijital 6y ago
  I guess that's true. Whats the end state if Apple refuses to pay?
  - eyelidlessness 6y ago
    “It would be a shame if someone used this vulnerability”
  - albntomat0 6y ago
    Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.

willyt 6y ago

Did he phone them to check? I get a lot of fake invoices in my junk mail. I also know someone who lost £50k paying an invoice with bank details that had been tampered with by hackers. I hate phoning people but I always phone about invoices.