3 ms·
> the idea that companies ruthlessly avoid paying bounties, which is, on information and belief, flatly false Eh, it's likely usually true, but I've worked fo
by sho 2y ago
> the idea that companies ruthlessly avoid paying bounties, which is, on information and belief, flatly false
Eh, it's likely usually true, but I've worked for a company which was attracted to the bounty program idea mainly for the optics and very much did push back on/was very reluctant to pay out on bounties.
And when I say "for the optics" I mean not only for the company being able to boast about having a bounty program but also the executive in question having something for his quarterly report. Having it not be too expensive was definitely part of the deal.
Needless to say this was a terrible company with terrible leadership, but it's a data point...
- smcin 2y agoOk but not a company as reputable as Apple, yes? Apple historically used to have a deservedly good reputation for this. I was quite shocked at this story.
- sho 2y ago> not a company as reputable as Apple, yes? Definitely not, in fact rather the opposite. I was just sharing the anecdote as a counter to the otherwise fairly blanket claims being made upstream.
- rfoo 2y ago> Apple historically used to have a deservedly good reputation for this. Are they? Apple only started their bug bounty program (with monetary rewards) merely 5 years ago, 12 years after first iOS release and well after everyone else. They are not very transparent about bugs and payouts (which is understandable) so I wonder where this good reputation comes from? (if you count their invitation-only program then it started in 2016, 8 years ago)