3 ms·

Zerodium is interesting. Apparently this bug would fetch "Up to $50k": https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_pric

Zerodium is interesting. Apparently this bug would fetch "Up to $50k": https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png Is there a way to verify whether Zerodium might be advertising large payouts (for attention) and then offering much smaller payouts for the actual bugs? It's pretty risky for Zerodium. There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor.

paulryanrogers 6y ago
> There's nothing stopping a researcher from collecting a payout and then reporting the bug to the vendor. Wouldn't the payout contract prohibit reporting to anyone else?
- sillysaurusx 6y ago
  What're they going to do if you break it? Sue? They might pay out over a long period of time for some guarantee that you'll play by their rules, though.
  - rfd4sgmk8u 6y ago
    There is a non-zero probability of not being alive any more. I don't think you understand the nature of that game.
- hnick 6y ago
  I think so, but would Zerodium etc be able to prove it was the same person in each case? An independent researcher might have submitted the same issue to Apple coincidentally shortly after, presented in a slightly different way.
  - saagarjha 6y ago
    Contracts usually pay out on a schedule. If the bug gets patched then you don’t get paid.
    - hnick 6y ago
      Makes sense, thanks. Must be tense waiting.
deleted 6y ago
[deleted]
vsareto 6y ago
$50k seems super low considering where Outlook is though. The exploit author hints at RCE being a possibility.