4 ms·
There have been many documented cases where tech giants have outright refused to pay out, employing practices like: changing the rules of engagement post-factum
by dotdi 2y ago
There have been many documented cases where tech giants have outright refused to pay out, employing practices like: changing the rules of engagement post-factum, silently banning security researchers from active bounties, escalating good-faith disclosures to law enforcement, extreme pettiness from managers, etc.
> The sums involved are not meaningful to the company
Which makes it the more bewildering to see how mishappen the handling is
- tptacek 2y agoGive me an example of a good-faith disclosure escalated to law enforcement? Some examples come to mind, but the ones I'm thinking of won't support your argument.
- Folcon 2y agoI'm sorry tptacet, some examples come to mind? I was really expecting you to say this doesn't happen, I'm now left wondering why security researcher's are willing to take such risks.
- tptacek 2y agoYou are generally not going to be legally liable for things you do in ordinary security research, but you will sure as hell be liable if you do unauthorized serverside research. Apple bounty stories are invariably about clientside work with little to no legal risk.