3 ms·

I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I ca

I looked for other buyers before Apple had a bug bounty program, not while talking with Apple. When I found an official way of submitting the vulnerability I cancelled my other negotiations (Apple is the correct channel and I wanted to see it fixed without exploitation). Regarding bounty amounts, I agree that they should clearly define the amounts for each factor of a complete exploit. That currently isn't done. The one thing everyone can give Zerodium credit for is being clear with their pricing, there's no ambiguity over whether you can keep your lights on by doing the research.

bink 5y ago
That's good. It's unfortunate that the best signal most companies can use for whether their bounty amounts are sufficient is report volume and quality rather than a pro-active "here's what others are paying" or impact to customers. If they set bounties too high initially they'll get swamped with low-quality reports and that will slow response times for the good ones. The bean counters also play a big role. Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. Security teams are aware of this and try to walk a fine line. For researchers who are having problems with programs I'd suggest trying to form a better relationship with the triage teams and security teams. Be helpful, not confrontational. Companies get their best bang-for-buck when they can court good researchers. They love getting quality researchers who report multiple findings and they'll do quite a lot to make them happy, including paying bonus bounties for future reports and being far more transparent with triage status.
- HelloNurse 5y ago
  > Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. At the beginning of a high profile bug bounty program I'd expect higher expenditure than in the following fiscal year due to the backlog of researchers who really want to "sell" to an official channel, not a slow start.
  - hluska 5y ago
    Shhhh! If you demonstrate such clear thinking you’ll never get promoted to management…:)

bink 5y ago

That's good. It's unfortunate that the best signal most companies can use for whether their bounty amounts are sufficient is report volume and quality rather than a pro-active "here's what others are paying" or impact to customers. If they set bounties too high initially they'll get swamped with low-quality reports and that will slow response times for the good ones. The bean counters also play a big role. Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. Security teams are aware of this and try to walk a fine line. For researchers who are having problems with programs I'd suggest trying to form a better relationship with the triage teams and security teams. Be helpful, not confrontational. Companies get their best bang-for-buck when they can court good researchers. They love getting quality researchers who report multiple findings and they'll do quite a lot to make them happy, including paying bonus bounties for future reports and being far more transparent with triage status.

HelloNurse 5y ago
> Most companies aren't ready for big bounty payouts when a program first starts. They set a fixed budget and are more likely to end a program completely if the bottom line cost is too high, regardless of the security impact. At the beginning of a high profile bug bounty program I'd expect higher expenditure than in the following fiscal year due to the backlog of researchers who really want to "sell" to an official channel, not a slow start.
- hluska 5y ago
  Shhhh! If you demonstrate such clear thinking you’ll never get promoted to management…:)