81–90 of 254 posts
Could it be that maybe they try to uphold the reputation of Apple by doing so? But it doesn't make sens either way because they could have just paid those guys and then everyone is happy. That's just some ass-backwards logic. I am an Apple fan and I'm not going to defend this. It's just plain bad behavior on their side.
I wish Apple would do a feature freeze for iOS and macOS for a couple of years, then focus on fixing bugs, improving security and optimizing performance instead.
Earlier quoted context omitted.
Is it moral though? What do they do with these exploits? If it is to help advance the agendas of countries like Israel and Saudi Arabia how would you feel submitting exploits to them?
You can choose between a rich murderous dictator and an arrogant IT company that does not give you a proper credit. Either way you are screwed as a security researcher :(
Earlier quoted context omitted.
> Next time I hope he sells his next vuln to the highest bidder And thereby accomplishing what, exactly? There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons.
>And thereby accomplishing what, exactly? ...$$$$?
Earlier quoted context omitted.
People worried about the morality aspect could sell the exploit, donate the money and report the issue to the manufacturer anyways.
I don't think Zerodium payouts are lump sum... I believe they are staggered in order to mitigate against this stuff.
Earlier quoted context omitted.
I'm so happy Linux is an option on the computer. When it comes to phones I feel stuck behind a rock and a hard place - choose iPhone, with poor Linux integration and threats to passively scan files on my phone and forward them to LEO? Sure, they have a decent record with security but these bug bounty reports haven't been great. Or choose Android, with its poor privacy record, a result of being built by an ad company…
Android doesn't scan your phone and mine it for data. Apps on Android scan your phone and mine it for data. Apps on iOS also scan your phone and mine it for data. The major difference between the two is that Android lets you choose which apps to put on your phone.
Earlier quoted context omitted.
> they're just incompetent / slow on this process > I feel for company leaders in this kind of shitty journalism You're not making sense. Plus Apple has a history of being incompetent and slow on this.
> Plus Apple has a history of being incompetent and slow on this Have they, really? Just because you find this instance here and there of such a story where they were, doesn't mean they have a history of being incompetent and slow on this (the same way someone who hit 99% of their three-pointers doesn't have a history of being an awful shooter). That's how they fare long term: https://www.pandasecurity.com/en/mediace…
Earlier quoted context omitted.
Maybe he doesn't want dissident journalists and activists to get spied on and chopped to pieces? That sounds like a good enough reason to report these bugs for someone with morals.
Dissident journalists and activists can use devices from vendors that care about security enough to run a working bug bounty program.
What a slap in the face. This guy is owed a boatload of cash, and typical Apple just kicks the can down the road. Next time I hope he sells his next vuln to the highest bidder.
> Next time I hope he sells his next vuln to the highest bidder And thereby accomplishing what, exactly? There is still merit, albeit not from a material wealth standpoint, for doing the right thing for the right reasons.
You can likely rely on a good majority of people to do the right thing when it isn't for or against their interests in any substantial way.
I'm not sure the amount of people that will do the right thing when it's not in their best interests by some small but noticeable amount.
I'm also not sure the amount of people that will do the right thing when it's vastly against their best interests, but it's bound to be far less that the prior group, and I suspect it's way below a majority.
The point isn't that these people aren't doing the "right thing", it's that these programs are designed to align doing the right thing with the best interests of the researchers, so noting that we might get more results that are not in the best interests of society at large or the company in question if they don't hold up to what they agreed to is not only a valid observation, it's the likely outcome if we're to expect these programs exist for a reason.
To put this in perspective, say you find a suitcase with a million dollars in it. You can turn it in, or you can keep it for yourself. If there's no real expectation you'll get anything if you turn it in, how does the reasoning go in your head? What if you know you'll get 10% for finding it and turning it in? What if you live in abject poverty? What if you have $60k worth of medical bills for a family member to pay off?