5 ms·

I assume you didn't tell Apple that you were negotiating with other buyers? I think most bug bounty programs will cut off communications at that point. I've ma

• netsec_burn 5y ago
  I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I cancelled my other negotiations (Apple is the correct channel and I wanted to see it fixed without exploitation). Regarding bounty amounts, I agree that they should clearly define the amounts for each factor of a complete exploit. That currently isn't done. The one thing everyone can give Zerodium credit for is being clear with their pricing, there's no ambiguity over whether you can keep your lights on by doing the research.
  • bink 5y ago
    That's good. It's unfortunate that the best signal most companies can use for whether their bounty amounts are sufficient is report volume and quality rather than a pro-active "here's what others are paying" or impact to customers. If they set bounties too high initially they'll get swamped with low-quality reports and that will slow response times for the good ones. The bean counters also play a big role. Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. Security teams are aware of this and try to walk a fine line. For researchers who are having problems with programs I'd suggest trying to form a better relationship with the triage teams and security teams. Be helpful, not confrontational. Companies get their best bang-for-buck when they can court good researchers. They love getting quality researchers who report multiple findings and they'll do quite a lot to make them happy, including paying bonus bounties for future reports and being far more transparent with triage status.
    • HelloNurse 5y ago
      > Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. At the beginning of a high profile bug bounty program I'd expect higher expenditure than in the following fiscal year due to the backlog of researchers who really want to "sell" to an official channel, not a slow start.
      • hluska 5y ago
        Shhhh! If you demonstrate such clear thinking you’ll never get promoted to management…:)
• intricatedetail 5y ago
  Why companies project this idea that it is wrong that people ask to be compensated fairly for their hard work? The culture of exploitation of engineers is sickening.
  • sircastor 5y ago
    Because it’s hard to distinguish between someone who’s trying to help you be more secure and someone who’s trying to extort hush money out of you for an error in your code. It’s not hard to read it as “we don’t negotiate with terrorists”, and Apple (or Google or Amazon…) know people think they have deep pockets
    • Teever 5y ago
      Does the difference really matter provided that the bug bounties are paying market rates for the bugs that people submit?
    • selfhoster11 5y ago
      What does it matter what the reporter's motivation is? The fact is, you have an unpatched vuln in your code, and you either pay up to discover more, or it blows up in your face an indeterminate amount of time later.
    • jjeaff 5y ago
      You mean they know people know they have deep pockets.