4 ms·

> Galov even proposed that Kaspersky donate the bounty to charity, but Apple rejected this, citing internal policies without explanation. I just don’t get why

by klabb3 2y ago

> Galov even proposed that Kaspersky donate the bounty to charity, but Apple rejected this, citing internal policies without explanation. I just don’t get why Apple wouldn’t cite the law if that’s the reason? Surely doesn’t look good on them if they’re just holding back bounties for undisclosed reasons.

analognoise 2y ago
That would be seen as payment to a sanctioned entity, right? Just because you donated the award to charity doesn’t mean it isn’t considered a transaction on behalf of a sanctioned entity. Makes total sense to me.
- AdamJacobMuller 2y ago
  If they money didn't flow through Kaspersky (the wording here of "Kaspersky" donating it vs Apple donating it is weird) and it was donated to a neutral charity (say, red cross or Médecins Sans Frontières), I don't think anyone would raise an eye on it.
  - analognoise 2y ago
    I think you’re underestimating the risk - it’s clear (to me anyway) that you cannot move money around at the request of a sanctioned entity; even if the money doesn’t “flow through” them, influence, goodwill and connections do - all of which are reasonable attack vectors for the sanctioned entity (Russia). Any potential downside far outweighs the upside. Apple does not want to get on the State Department’s shit list, period, and certainly not to do goodwill efforts for the Russians.
- throwaway199956 2y ago
  Is Kaspersky sanctioned?
AdamJacobMuller 2y ago
I don't think it has any benefit for them to explain why. Explaining why just invites argument. "Oh, you can't pay because we are in Russia, just pay to our Massachusetts subsidiary!"
- bastard_op 2y ago
  I was thinking this exact thing, they have the Massachusetts subsidiary, so why not? I would still call this a "refuse to" vs "can do", but hey, Apple can keep that money - keeps the layoffs away.
  - toomuchtodo 2y ago
    Violating OFAC sanctions can result in extreme consequences, including prison for up to 30 years and fines in the millions of dollars. It would be prudent and reasonable for Apple to do nothing rather then to do something that invites this type of inquiry. To do nothing invites, at most, a de minimis amount of reputational risk.
    - mcv 2y ago
      Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.
      - toomuchtodo 2y ago
        If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.
        pdpi 2y ago
        Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will. It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.

by klabb3 2y ago

analognoise 2y ago

That would be seen as payment to a sanctioned entity, right? Just because you donated the award to charity doesn’t mean it isn’t considered a transaction on behalf of a sanctioned entity. Makes total sense to me.

AdamJacobMuller 2y ago
If they money didn't flow through Kaspersky (the wording here of "Kaspersky" donating it vs Apple donating it is weird) and it was donated to a neutral charity (say, red cross or Médecins Sans Frontières), I don't think anyone would raise an eye on it.
- analognoise 2y ago
  I think you’re underestimating the risk - it’s clear (to me anyway) that you cannot move money around at the request of a sanctioned entity; even if the money doesn’t “flow through” them, influence, goodwill and connections do - all of which are reasonable attack vectors for the sanctioned entity (Russia). Any potential downside far outweighs the upside. Apple does not want to get on the State Department’s shit list, period, and certainly not to do goodwill efforts for the Russians.
throwaway199956 2y ago
Is Kaspersky sanctioned?

AdamJacobMuller 2y ago

I don't think it has any benefit for them to explain why. Explaining why just invites argument. "Oh, you can't pay because we are in Russia, just pay to our Massachusetts subsidiary!"

bastard_op 2y ago
I was thinking this exact thing, they have the Massachusetts subsidiary, so why not? I would still call this a "refuse to" vs "can do", but hey, Apple can keep that money - keeps the layoffs away.
- toomuchtodo 2y ago
  Violating OFAC sanctions can result in extreme consequences, including prison for up to 30 years and fines in the millions of dollars. It would be prudent and reasonable for Apple to do nothing rather then to do something that invites this type of inquiry. To do nothing invites, at most, a de minimis amount of reputational risk.
  - mcv 2y ago
    Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.
    - toomuchtodo 2y ago
      If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.
      - pdpi 2y ago
        Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will. It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.