4 ms·

Here's my totally outsider informed guesswork. We've seen similar problems recently with Microsoft, where legitimate sounding issues are denied bounties, so thi

Here's my totally outsider informed guesswork. We've seen similar problems recently with Microsoft, where legitimate sounding issues are denied bounties, so this kind of issue is not unique to Apple. My guess would be, that MSRC and Apple's equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do "well run" companies do with cost centres... they minimize them :) I don't think that organizationally either company wants to have bad security, and I don't think that individual staff in those companies want to have bad security, but I do think that incentive structures have been set-up in a way that leads to this kind of problem. I've seen this described as lack of resources in the affected teams, but realistically these companies have effectively limitless resources, it's that they're not assigning them to these areas.

EMM_386 5y ago
> My guess would be, that MSRC and Apple's equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do "well run" companies do with cost centres... they minimize them :) It would have to be this. If you start to increase the payout, you get more people wanting the payout.
theluketaylor 5y ago
Apple does not have cost and profit centers. They maintain a single profit and loss balance sheet for the entire company. That doesn't mean the functional areas don't have a budget or resource constraints, but Apple's structure is quite different from most companies. I'd agree with the other comments that pin Apple's specific issues on their insular culture that discourages all forms of external communication if you're not part of marketing. Great bug bountry programs require good communication with researchers and some level of transparency, two things apple is structured to avoid and discourage.
nikster 5y ago
My hypothesis is a lot simpler: Hacking is much more profitable than preventing hacking. Incentives are heavily biased towards security exploits on all levels. End of story. There's no reward for "your code never got hacked". There's a reward for delivering a feature in time and a penalty for not doing so. You'll get a bonus or promotion for delivering features. If you take twice as long because you made your code really secure - no one will know. I think that's really all there is to it. Security is obscure and complicated.

EMM_386 5y ago

> My guess would be, that MSRC and Apple's equivalent have an OKR about keeping bounties under a certain level. Security is seen as a cost centre by most companies, and what do "well run" companies do with cost centres... they minimize them :) It would have to be this. If you start to increase the payout, you get more people wanting the payout.

theluketaylor 5y ago

Apple does not have cost and profit centers. They maintain a single profit and loss balance sheet for the entire company. That doesn't mean the functional areas don't have a budget or resource constraints, but Apple's structure is quite different from most companies. I'd agree with the other comments that pin Apple's specific issues on their insular culture that discourages all forms of external communication if you're not part of marketing. Great bug bountry programs require good communication with researchers and some level of transparency, two things apple is structured to avoid and discourage.

nikster 5y ago

My hypothesis is a lot simpler: Hacking is much more profitable than preventing hacking. Incentives are heavily biased towards security exploits on all levels. End of story. There's no reward for "your code never got hacked". There's a reward for delivering a feature in time and a penalty for not doing so. You'll get a bonus or promotion for delivering features. If you take twice as long because you made your code really secure - no one will know. I think that's really all there is to it. Security is obscure and complicated.