31–40 of 40 posts
Earlier quoted context omitted.
Here are the categories: https://security.apple.com/bounty/categories/ I'm not really sure what else you're asking for. Nobody in the world except Apple Product Security itself knows why Apple Product Security is refusing to pay a bounty in this case. It makes no sense.
Well. He knows more about the exploit. Maybe he could tell us what it is.
Satisfied now?
No idea why is Apple being greedy here. They have enough money and there are going to be buyers out there, who are going to have other intentions, which could become much more expensive for Apple. Save a cent to lose dollar kind of situation.
This is 'just' a skill issue. Culturally, it's seems this is not a process they're very good at running. A bunch of similarities to their App Review process which isn't well regarded.
I think this is actually the security researcher's fault. If you read the small print, this kernel bug doesn't meet the Bug Bounty Qualification Criteria of being on an OS that Apple actually gives a shit about.
I think this is actually the security researcher's fault. If you read the small print, this kernel bug doesn't meet the Bug Bounty Qualification Criteria of being on an OS that Apple actually gives a shit about.
They did Apple a solid, but not in accordance with the precise terms as laid out by Apple, so it's perfectly justified for Apple to take the researcher's work for nothing?
Is this normal? I’m only ancillary to security stuff like this but without details of the exploit it’s hard to say whether or not this is scandalous or not. It’s possible Apple made a mistake here, but is that a more likely scenario than the vuln just not being exploitable enough to warrant a bounty?
This is very much not normal and is absolutely a scandal.
They have a long history of refusing to pay bug bounties.
Not a great look when many responses are "if the provider won't protect people, then the researcher should contemplate hurting people".
Earlier quoted context omitted.
Well. He knows more about the exploit. Maybe he could tell us what it is.
He did: https://twitter.com/R00tkitSMM/status/1790391961737711697 Satisfied now?
Earlier quoted context omitted.
He did: https://twitter.com/R00tkitSMM/status/1790391961737711697 Satisfied now?
Updated from his twitter: apple apparently confirmed i am right and that it’s not exploitable in real user software. Still outraged?
Earlier quoted context omitted.
This is very much not normal and is absolutely a scandal.
It's pretty normal for Apple, tbh. They have a long history of refusing to pay bug bounties.