5 ms·
A lot of commenters point to the heaps of money. But what do you buy with it? How do you build it up at this scale? Security isn't a metric you can reliably wor
by poisonborz 5y ago
A lot of commenters point to the heaps of money. But what do you buy with it? How do you build it up at this scale? Security isn't a metric you can reliably work by like clicks, op/s and sales. And beyond a very narrow frame it won't help their case of being a producer of consumer products, rather it makes very difficult to work with state actors.
- blip54321 5y agoRaising bug bounties by an order of magnitude goes a long ways. Apple's program is pretty good relative to industry norms, but all of the programs are well below black/gray market prices for exploits, and most are below costs to find, document, and submit an exploit. Google pays less than a month's salary for their most serious Chrome exploits, for example: https://bughunters.google.com/about/rules/5745167867576320 https://bughunters.google.com/about/rules/5745167867576320 I think all this is good until an adversary decides to brick every iDevice, Android, Windows, MacOS, and Linux machine in the US. And by "brick", I mean overwrite firmwares, disable fans, and run at maximum load.
- fomine3 5y agoI saw bad bug reporting/bounty stories here about Apple. I believe Apple improve this zone without huge investment.