6 ms·
I found 75k for such a severe security issue a low figure, on apple security bounty page the max pay for such exploit is 500k. https://developer.apple.com/secur
by rasta78 6y ago
I found 75k for such a severe security issue a low figure, on apple security bounty page the max pay for such exploit is 500k.
https://developer.apple.com/security-bounty/ https://developer.apple.com/security-bounty/
- mulmen 6y agoIt’s a bug in Safari, not in the webcam so that may be why?
- save_ferris 6y agoThat could be, but it’s still far too low. I imagine that a Black Mirror type of scandal involving this exploit could do many millions if not billions in damage to Apple’s finances. Not to mention what such an exploit might fetch on the black market.
- elldoubleyew 6y agoI firmly believe that a government intelligence operation would be willing to pay far more than 75k for this.
- saagarjha 6y agoBug bounty payouts are not meant to match what you can get on the black market.
- mulmen 6y agoThat seems like a major flaw in bug bounties then. What else could they be competing with?
- saagarjha 6y agoThere's more to the black market than just money: you often need to deal with unscrupulous individuals (possibly a couple of levels removed) and risk going to jail. The bounty incentivizes researchers to research and disclose, not disincentive people who were going to sell them anyways (who will pay whatever it costs to get these anyways).
- Talanes 6y agoThe black market responds to the legal markets. Unless you think that these companies can ultimately win a bidding war against black market actors, trying too desperately to win over the black hats will just enrich them further.
- save_ferris 6y agoI disagree, they’re designed to incentivize people not to sell such secrets on the black market. If this wasn’t true, these programs wouldn’t exist. They’ve just gotten used to banking on people taking much less than black market value in order to avoid legal complications.
- saagarjha 6y agoThey're designed to disincentivize moral people from selling such secrets on the black market, and show that companies care about fixing bugs. Authoritarian governments will always be more than willing to offer large sums of money for such exploits.