4 ms·

I don't think it has any benefit for them to explain why. Explaining why just invites argument. "Oh, you can't pay because we are in Russia, just pay to our Ma

I don't think it has any benefit for them to explain why. Explaining why just invites argument. "Oh, you can't pay because we are in Russia, just pay to our Massachusetts subsidiary!"

bastard_op 2y ago
I was thinking this exact thing, they have the Massachusetts subsidiary, so why not? I would still call this a "refuse to" vs "can do", but hey, Apple can keep that money - keeps the layoffs away.
- toomuchtodo 2y ago
  Violating OFAC sanctions can result in extreme consequences, including prison for up to 30 years and fines in the millions of dollars. It would be prudent and reasonable for Apple to do nothing rather then to do something that invites this type of inquiry. To do nothing invites, at most, a de minimis amount of reputational risk.
  - mcv 2y ago
    Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.
    - toomuchtodo 2y ago
      If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.
      - pdpi 2y ago
        Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will. It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.
        xw390112 2y ago
        “probably fine” is not the comment I would’ve wanted from my lawyer. There are tons of ways this could’ve gone south. For example, which charity? What if Kaspersky benefited from a tax break as a result. Etc. etc. why take a chance?
  - chatmasta 2y ago
    So why are they even able to have the Massachusetts subsidiary? Is every vendor doing business with that corporation also violating sanctions?
cqqxo4zV46cp 2y ago
Yep. Despite the Hacker News peanut gallery essentially yelling “debate me!”, exposing the public to these specifics has never been part of Apple’s MO.
Hizonner 2y ago
> Explaining why just invites argument. ... and who knows where that could lead. Why, the rabble might get the idea that they're allowed to disapprove of decisions Apple makes!
klabb3 2y ago
> I don't think it has any benefit for them to explain why. It clearly has. There are lots of hackers and security researchers who will make very different decisions depending on if they expect Apple will honor their bounties. Traditionally, people who report security bugs have been treated poorly, and arbitrary rejections certainly helps move the incentives towards the exploit market instead.

I don't think it has any benefit for them to explain why. Explaining why just invites argument. "Oh, you can't pay because we are in Russia, just pay to our Massachusetts subsidiary!"

bastard_op 2y ago

I was thinking this exact thing, they have the Massachusetts subsidiary, so why not? I would still call this a "refuse to" vs "can do", but hey, Apple can keep that money - keeps the layoffs away.

toomuchtodo 2y ago
Violating OFAC sanctions can result in extreme consequences, including prison for up to 30 years and fines in the millions of dollars. It would be prudent and reasonable for Apple to do nothing rather then to do something that invites this type of inquiry. To do nothing invites, at most, a de minimis amount of reputational risk.
- mcv 2y ago
  Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.
  - toomuchtodo 2y ago
    If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.
    - pdpi 2y ago
      Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will. It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.
      - xw390112 2y ago
        “probably fine” is not the comment I would’ve wanted from my lawyer. There are tons of ways this could’ve gone south. For example, which charity? What if Kaspersky benefited from a tax break as a result. Etc. etc. why take a chance?
- chatmasta 2y ago
  So why are they even able to have the Massachusetts subsidiary? Is every vendor doing business with that corporation also violating sanctions?

cqqxo4zV46cp 2y ago

Yep. Despite the Hacker News peanut gallery essentially yelling “debate me!”, exposing the public to these specifics has never been part of Apple’s MO.

Hizonner 2y ago

> Explaining why just invites argument. ... and who knows where that could lead. Why, the rabble might get the idea that they're allowed to disapprove of decisions Apple makes!

klabb3 2y ago

> I don't think it has any benefit for them to explain why. It clearly has. There are lots of hackers and security researchers who will make very different decisions depending on if they expect Apple will honor their bounties. Traditionally, people who report security bugs have been treated poorly, and arbitrary rejections certainly helps move the incentives towards the exploit market instead.