4 ms·

I agree with the rest of your comment, but this > Even for a company the size of Apple, putting up $10 million to fund organizations that investigate, expose,

by jorvi 4y ago

I agree with the rest of your comment, but this > Even for a company the size of Apple, putting up $10 million to fund organizations that investigate, expose, and prevent highly targeted cyberattacks isn't pocket change. is kind of funny, as it’s about 1/20000 of their total cash reserves. With 20000 in my savings account, it’d be equivalent to giving 1 dollar to charity. In other words, pocket change :)

PoignardAzur 4y ago
It's still ridiculously good by bug bounty standards. Zero-day buyers are going to have a hard time topping that.
- O__________O 4y ago
  Bounty is $2 million, grant is $10 million. You could easily get more for selling a zero-day likely this than reporting it to Apple. If you combined the risk this is being turned on is reported back to Apple or remotely detectable, combined with a zero day, it would be a goldmine; cover this and other issues in my comments on the topic: https://news.ycombinator.com/item?id=32006436 https://news.ycombinator.com/item?id=32006436
  - hsbauauvhabzb 4y ago
    I like money but something tells me targets of such attacks might end up dead, so it’s more about ethical considerations rather than who pays better. The bounty won’t sway everyone but $2m would sway more people than $1m which would be more than $10k
jjtheblunt 4y ago
where are the cash reserves documented?
- zie 4y ago
  see: https://investor.apple.com/investor-relations/default.aspx https://investor.apple.com/investor-relations/default.aspx Specifically the 2022 Q2 financial statement(it's a PDF). under "Cash and Cash equivalents" on the 2nd page, you will see: 28,098 That's in millions of dollars(see top of that page for source), so they have 28 Billion USD just laying around. 10M/28098M = 0.0004 so it's 0.04% of their cash.
  - jjtheblunt 4y ago
    Thank you

4 ms·

I agree with the rest of your comment, but this > Even for a company the size of Apple, putting up $10 million to fund organizations that investigate, expose,

by jorvi 4y ago

PoignardAzur 4y ago
It's still ridiculously good by bug bounty standards. Zero-day buyers are going to have a hard time topping that.
- O__________O 4y ago
  Bounty is $2 million, grant is $10 million. You could easily get more for selling a zero-day likely this than reporting it to Apple. If you combined the risk this is being turned on is reported back to Apple or remotely detectable, combined with a zero day, it would be a goldmine; cover this and other issues in my comments on the topic: https://news.ycombinator.com/item?id=32006436 https://news.ycombinator.com/item?id=32006436
  - hsbauauvhabzb 4y ago
    I like money but something tells me targets of such attacks might end up dead, so it’s more about ethical considerations rather than who pays better. The bounty won’t sway everyone but $2m would sway more people than $1m which would be more than $10k
jjtheblunt 4y ago
where are the cash reserves documented?
- zie 4y ago
  see: https://investor.apple.com/investor-relations/default.aspx https://investor.apple.com/investor-relations/default.aspx Specifically the 2022 Q2 financial statement(it's a PDF). under "Cash and Cash equivalents" on the 2nd page, you will see: 28,098 That's in millions of dollars(see top of that page for source), so they have 28 Billion USD just laying around. 10M/28098M = 0.0004 so it's 0.04% of their cash.
  - jjtheblunt 4y ago
    Thank you