Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Officially Announces Bug Bounty Program Covering All of Its Software

macrumors.com

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#21

Post by setr »

simias wrote: post #12
rvz wrote: post #8

Just imagine if those iBoot exploits were all reported for cash to Apple. Essentially we get less freedom from our devices to do whatever with them. Apple's bug bounty announcement is just a response to tighten up their walled garden. You'd think that macOS will be as limited as a desktop `OS like iOS and iPadOS is. I admired the pirate vs navy culture Apple had in the past, but now they are neither and now become an…

Nobody forces you to buy Apple products, it's pretty weird to buy a product and then hope for a security flaw in order to use it the way you want.

But that's how I've been dealing with video games consoles for decades... Though usually after the flaw is found

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#23

Post by Chris_Chambers »

krisoft wrote: post #15
harikb wrote: post #14

Earlier quoted context omitted.

“ Apple says it will add a 50 percent bonus on top of the standard payout for bugs found in beta software, which allows the company to nix the issue before the OS version goes public. It is also offering the same bonus for so-called "regression bugs"” Quite interesting their treatment of beta. I would have thought reverse.

If you do it in reverse then you are incentivising people to hoard the bugs until release.

If you have bug bounties at all then you are incentivizing employees to create subtle bugs on purpose to have their accomplices outside the company “discover” later.

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#24

Post by [deleted] »

krisoft wrote: post #15
harikb wrote: post #14

Earlier quoted context omitted.

“ Apple says it will add a 50 percent bonus on top of the standard payout for bugs found in beta software, which allows the company to nix the issue before the OS version goes public. It is also offering the same bonus for so-called "regression bugs"” Quite interesting their treatment of beta. I would have thought reverse.

If you do it in reverse then you are incentivising people to hoard the bugs until release.

[deleted]

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#25

Post by Razengan »

I wish Apple would also improve their process for handling “ordinary” non-security bugs.

Since the WWDC 2019 betas and even after release all the way through to the latest updates today, I still run into a bug in Apple software and services, even their IDE and APIs, almost every single day.

Just a few hours ago I had to hard-reset my MacBook because it failed to wake from sleep (beachballed) after plugging in.

This has happened a few times on my barely-a-year old MBP running the latest Catalina, freshly installed and without any system-level/third-party modifications. This is not really acceptable and triggers horrible flashbacks of my time in the Microsoft trenches.

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#26

Post by threeseed »

Razengan wrote: post #25

I wish Apple would also improve their process for handling “ordinary” non-security bugs. Since the WWDC 2019 betas and even after release all the way through to the latest updates today, I still run into a bug in Apple software and services, even their IDE and APIs, almost every single day. Just a few hours ago I had to hard-reset my MacBook because it failed to wake from sleep (beachballed) after plugging in. This h…

Log the bug at http://bugreporter.apple.com

And then encourage others to also log the bug.

Apple prioritises which bugs to fix based on the severity and how common it is.

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#27

Post by Rebelgecko »

threeseed wrote: post #26
Razengan wrote: post #25

I wish Apple would also improve their process for handling “ordinary” non-security bugs. Since the WWDC 2019 betas and even after release all the way through to the latest updates today, I still run into a bug in Apple software and services, even their IDE and APIs, almost every single day. Just a few hours ago I had to hard-reset my MacBook because it failed to wake from sleep (beachballed) after plugging in. This h…

Log the bug at http://bugreporter.apple.com And then encourage others to also log the bug. Apple prioritises which bugs to fix based on the severity and how common it is.

Last time I tried to use their new bug reporter (feedbackassistant.apple.com), I got distracted by reporting all of the bugs in the bug reporter itself. It's utterly fucked up on desktop Firefox and the mobile version of Chrome. Try going to the "Where would you like to start your feedback?" page and shrinking the window until not everything is visible at once. It's impossible scroll down, so you can't file any bugs (except for maybe watchOS bugs because that's at the top of the list).

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#28

Post by monocasa »

threeseed wrote: post #26
Razengan wrote: post #25

I wish Apple would also improve their process for handling “ordinary” non-security bugs. Since the WWDC 2019 betas and even after release all the way through to the latest updates today, I still run into a bug in Apple software and services, even their IDE and APIs, almost every single day. Just a few hours ago I had to hard-reset my MacBook because it failed to wake from sleep (beachballed) after plugging in. This h…

Log the bug at http://bugreporter.apple.com And then encourage others to also log the bug. Apple prioritises which bugs to fix based on the severity and how common it is.

They hide other instances of bugs so you can't tell if they're de duping them correctly.

They also close them for ridiculous reasons. We've been told stuff like "diskutil isn't meant for root filesystems", etc.

As someone writing fairly low level system code for MacOS as a day job, we've institutionally given up on Apple's bug report process. It eats a lot of developer time and has never had a positive outcome for us.

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#29

Post by saagarjha »

threeseed wrote: post #26
Razengan wrote: post #25

I wish Apple would also improve their process for handling “ordinary” non-security bugs. Since the WWDC 2019 betas and even after release all the way through to the latest updates today, I still run into a bug in Apple software and services, even their IDE and APIs, almost every single day. Just a few hours ago I had to hard-reset my MacBook because it failed to wake from sleep (beachballed) after plugging in. This h…

Log the bug at http://bugreporter.apple.com And then encourage others to also log the bug. Apple prioritises which bugs to fix based on the severity and how common it is.

Apple's "improvement" in that area this year has largely had no effect or even negative ones in certain cases.

Re: Apple Officially Announces Bug Bounty Program Covering All of Its Software

#30

Post by pabs3 »

I heard a rumor that Apple has never paid out any money in their invite-only bug bounty days. This 2018 article seems to suggest that is true. Does anyone have any data to the contrary?

https://www.vice.com/en_us/article/7xqdxe/google-project-zer...

Post reply on HN