4 ms·

It's a lot of talk, but I doubt Apple's honesty here. See also Gui Rambo getting a measly $7,000 for a couple of fairly serious vulnerabilities. https://news.

It's a lot of talk, but I doubt Apple's honesty here. See also Gui Rambo getting a measly $7,000 for a couple of fairly serious vulnerabilities. https://news.ycombinator.com/item?id=33348013 https://news.ycombinator.com/item?id=33348013

twosdai 4y ago
Yeah I love the idea of bug bounties, however there is this issue created when the provider cannot offer the most competitive price for bounties. It's no secret that nation states will pay more than Apple will for vulnerabilities.
- tornato7 4y ago
  There's no reason Apple couldn't pay more than nation-states for bug bounties; They have a ridiculous amount of money after all. In Crypto there exists a service called ImmuneFi, it's essentially a arbitrator between hackers and services offering bug bounties that provides an impartial third party ruling on the payout. They recently paid out a $10 million bug bounty. That really needs to move into Web2.
  - JumpCrisscross 4y ago
    > recently paid out a $10 million bug bounty ImmuneFi have "paid out +$10,000,000 in bounties" [1]. Not $10mm for a single bounty. [1] https://immunefi.com/hackers/ https://immunefi.com/hackers/
    - tornato7 4y ago
      That is incorrect: https://www.globenewswire.com/news-release/2022/09/22/2521149/0/en/Leading-Web3-Bug-Bounty-Platform-Immunefi-Raises-24M-Series-A-led-by-Framework-Ventures.html https://www.globenewswire.com/news-release/2022/09/22/252114... > Immunefi has saved over $25 billion in users’ funds and has paid out $60 million in total bounties. The platform now supports 300 projects across multiple crypto sectors, and collectively offers $135 million in bounties to whitehat hackers. Immunefi has also facilitated the largest bug bounty payments in the history of software, including $10 million for a vulnerability discovered in Wormhole, a generic cross-chain messaging protocol, and $6 million for a vulnerability discovered in Aurora, a bridge and a scaling solution for Ethereum.
  - donkeyd 4y ago
    That would just create a bidding war and wouldn't stop the arms race at all. Also, once the rewards increase past a certain point, security researchers would have no reason to work for apple, since one big hit would mean set for life.
    - tornato7 4y ago
      Security researchers on ImmuneFi can be set for life by submitting a large bug bounty today. But that's extremely rare, and you don't see them lining up to leave apple.
concinds 4y ago
Under the detailed criteria listed here[0], it seems plain that he qualified for the $50k award when it comes to the Mac vulnerability, and the $25k award for the iOS one. Since they're fundamentally the same flaw, he'd likely only qualify for $50k, not $75k, but Apple still stiffed him of $43k. For shame. [0]: https://security.apple.com/bounty/categories/ https://security.apple.com/bounty/categories/
deleted 4y ago
[deleted]

twosdai 4y ago

Yeah I love the idea of bug bounties, however there is this issue created when the provider cannot offer the most competitive price for bounties. It's no secret that nation states will pay more than Apple will for vulnerabilities.

tornato7 4y ago
There's no reason Apple couldn't pay more than nation-states for bug bounties; They have a ridiculous amount of money after all. In Crypto there exists a service called ImmuneFi, it's essentially a arbitrator between hackers and services offering bug bounties that provides an impartial third party ruling on the payout. They recently paid out a $10 million bug bounty. That really needs to move into Web2.
- JumpCrisscross 4y ago
  > recently paid out a $10 million bug bounty ImmuneFi have "paid out +$10,000,000 in bounties" [1]. Not $10mm for a single bounty. [1] https://immunefi.com/hackers/ https://immunefi.com/hackers/
  - tornato7 4y ago
    That is incorrect: https://www.globenewswire.com/news-release/2022/09/22/2521149/0/en/Leading-Web3-Bug-Bounty-Platform-Immunefi-Raises-24M-Series-A-led-by-Framework-Ventures.html https://www.globenewswire.com/news-release/2022/09/22/252114... > Immunefi has saved over $25 billion in users’ funds and has paid out $60 million in total bounties. The platform now supports 300 projects across multiple crypto sectors, and collectively offers $135 million in bounties to whitehat hackers. Immunefi has also facilitated the largest bug bounty payments in the history of software, including $10 million for a vulnerability discovered in Wormhole, a generic cross-chain messaging protocol, and $6 million for a vulnerability discovered in Aurora, a bridge and a scaling solution for Ethereum.
- donkeyd 4y ago
  That would just create a bidding war and wouldn't stop the arms race at all. Also, once the rewards increase past a certain point, security researchers would have no reason to work for apple, since one big hit would mean set for life.
  - tornato7 4y ago
    Security researchers on ImmuneFi can be set for life by submitting a large bug bounty today. But that's extremely rare, and you don't see them lining up to leave apple.

concinds 4y ago

Under the detailed criteria listed here[0], it seems plain that he qualified for the $50k award when it comes to the Mac vulnerability, and the $25k award for the iOS one. Since they're fundamentally the same flaw, he'd likely only qualify for $50k, not $75k, but Apple still stiffed him of $43k. For shame. [0]: https://security.apple.com/bounty/categories/ https://security.apple.com/bounty/categories/

deleted 4y ago

[deleted]