Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple says kernel vulnerability is not eligible for bounty

twitter.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Apple says kernel vulnerability is not eligible for bounty

#21

Post by bastawhiz »

hifromwork wrote: post #15
sirwhinesalot wrote: post #10

Earlier quoted context omitted.

Next time it's where it should go. Clearly Apple doesn't mind.

Promise of getting more money is not a justification for selling exploits to the criminals. Even if Apple had no bug bounty program, reporting it responsibly is the moral thing to do.

That's easy to say when you're not a security researcher whose income depends on getting paid for finding vulnerabilities—a career that wouldn't exist if Apple hadn't created the bounty program in the first place. It's really bad when you do good work that a third party goes back on their promise to pay you for: it's not always possible to accept the L and move on without pay.

Re: Apple says kernel vulnerability is not eligible for bounty

#22

Post by citizen_friend »

lapcat wrote: post #17
citizen_friend wrote: post #14

So are we going to take this twitter post at face value? Anyone have more info?

Yes, it's literally the first item in the iOS 17.5 security release notes: https://support.apple.com/HT214101

Yep, that was in the tweet. Got any more info about the exploit or why it’s not in their categories?

I presume some in the list did received bounties?

Re: Apple says kernel vulnerability is not eligible for bounty

#23

Post by hifromwork »

bastawhiz wrote: post #21
hifromwork wrote: post #15

Earlier quoted context omitted.

Promise of getting more money is not a justification for selling exploits to the criminals. Even if Apple had no bug bounty program, reporting it responsibly is the moral thing to do.

That's easy to say when you're not a security researcher whose income depends on getting paid for finding vulnerabilities—a career that wouldn't exist if Apple hadn't created the bounty program in the first place. It's really bad when you do good work that a third party goes back on their promise to pay you for: it's not always possible to accept the L and move on without pay.

I'm a security researcher, but it's true that my income doesn't depend on getting paid for security vulnerabilities[1]. On the other hand, I'm old enough to remember when bug bounties didn't exist and yet (most) people did the right thing and disclosed their finds responsibly.

If the bug from OP falls under Apple's bug bounty and yet Apple refuses to pay, it's a very shitty behaviour and I hope they're forced to pay by the backlash and the researcher is made right. But if not, the reasonable response is to stop doing security research for free for Apple, not doing research with a goal of using it immorally due to a kneejerk reaction. If Apple stops their bug bounty program today this is still not a justification to look for vulnerabilities in their products and sell them on the black market.

[1] I'm mostly dealing with the people abusing the vulnerabilities, so that may influence my worldview.

Re: Apple says kernel vulnerability is not eligible for bounty

#24

Post by iwontberude »

More generally, bug bounties are not a significant industry for getting people paid, Hacker1 is Uber/Lyft for hackers. Maybe in some markets bug bounties are actually valuable relative to the prices of things, but in America it’s basically impossible to pay people what they are worth to find bugs.

Re: Apple says kernel vulnerability is not eligible for bounty

#25

Post by lapcat »

citizen_friend wrote: post #22
lapcat wrote: post #17

Earlier quoted context omitted.

Yes, it's literally the first item in the iOS 17.5 security release notes: https://support.apple.com/HT214101

Yep, that was in the tweet. Got any more info about the exploit or why it’s not in their categories? I presume some in the list did received bounties?

Here are the categories: https://security.apple.com/bounty/categories/

I'm not really sure what else you're asking for. Nobody in the world except Apple Product Security itself knows why Apple Product Security is refusing to pay a bounty in this case. It makes no sense.

Re: Apple says kernel vulnerability is not eligible for bounty

#26

Post by ffsm8 »

hifromwork wrote: post #23
bastawhiz wrote: post #21

Earlier quoted context omitted.

That's easy to say when you're not a security researcher whose income depends on getting paid for finding vulnerabilities—a career that wouldn't exist if Apple hadn't created the bounty program in the first place. It's really bad when you do good work that a third party goes back on their promise to pay you for: it's not always possible to accept the L and move on without pay.

I'm a security researcher, but it's true that my income doesn't depend on getting paid for security vulnerabilities[1]. On the other hand, I'm old enough to remember when bug bounties didn't exist and yet (most) people did the right thing and disclosed their finds responsibly. If the bug from OP falls under Apple's bug bounty and yet Apple refuses to pay, it's a very shitty behaviour and I hope they're forced to pay…

> yet (most) people did the right thing and disclosed their finds responsibly.

How would you know? I'm not a security researcher and still know that there were always multiple avenues for selling vulns, and most weren't public.

So really, what makes you think you can make that statement with any kind of confidence?

Re: Apple says kernel vulnerability is not eligible for bounty

#28

Post by bastawhiz »

hifromwork wrote: post #23
bastawhiz wrote: post #21

Earlier quoted context omitted.

That's easy to say when you're not a security researcher whose income depends on getting paid for finding vulnerabilities—a career that wouldn't exist if Apple hadn't created the bounty program in the first place. It's really bad when you do good work that a third party goes back on their promise to pay you for: it's not always possible to accept the L and move on without pay.

I'm a security researcher, but it's true that my income doesn't depend on getting paid for security vulnerabilities[1]. On the other hand, I'm old enough to remember when bug bounties didn't exist and yet (most) people did the right thing and disclosed their finds responsibly. If the bug from OP falls under Apple's bug bounty and yet Apple refuses to pay, it's a very shitty behaviour and I hope they're forced to pay…

It's pretty undeniable that there exists a significant cohort of folks whose sole reason for getting into security is to find vulnerabilities to collect bounties. Beg bounties are that taken to an extreme.

> But if not, the reasonable response is to stop doing security research for free for Apple, not doing research with a goal of using it immorally due to a kneejerk reaction.

I'm sure lots of people will! But that won't necessarily stop folks from saying "I've discovered a vulnerability that would yield me an amount of money that would substantially improve my near-to-medium-term quality of life" and doing what's necessary to profit from that. Apple's program _necessarily_ inflates the amount of money a vulnerability sells for through immoral channels regardless of whether anyone is participating in it.

> If Apple stops their bug bounty program today this is still not a justification to look for vulnerabilities in their products and sell them on the black market.

This might be true for you, but that doesn't mean it's true for even a majority of other people.

Re: Apple says kernel vulnerability is not eligible for bounty

#29

Post by citizen_friend »

lapcat wrote: post #25
citizen_friend wrote: post #22

Earlier quoted context omitted.

Yep, that was in the tweet. Got any more info about the exploit or why it’s not in their categories? I presume some in the list did received bounties?

Here are the categories: https://security.apple.com/bounty/categories/ I'm not really sure what else you're asking for. Nobody in the world except Apple Product Security itself knows why Apple Product Security is refusing to pay a bounty in this case. It makes no sense.

Well. He knows more about the exploit. Maybe he could tell us what it is.

Re: Apple says kernel vulnerability is not eligible for bounty

#30

Post by archagon »

netshade wrote: post #12

Not a great look when many responses are "if the provider won't protect people, then the researcher should contemplate hurting people".

No, this is simply cause and effect. I wager a number of security researchers don’t find any moral issue with selling exploits, but prefer to be paid a bounty by the big corp due to ease and cachet. If that’s no longer tenable, they will hold up their middle fingers and just keep doing what they do. You can tell them they’re acting immorally all day long, but you will only be wasting your breath.
Post reply on HN