2 ms·

Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.

• toomuchtodo 2y ago
  If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.
  • pdpi 2y ago
    Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will. It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.
    • xw390112 2y ago
      “probably fine” is not the comment I would’ve wanted from my lawyer. There are tons of ways this could’ve gone south. For example, which charity? What if Kaspersky benefited from a tax break as a result. Etc. etc. why take a chance?