Live data from Hacker News

Apple announces bug bounty program

techcrunch.com

71–80 of 107 posts

Re: Apple announces bug bounty program

#71
post #56

Earlier quoted context omitted.

How is this relevant to discussion. This shit ruins the site. At least provide any content to your comment.

Complaining about a poke at Apple is irrelevant. That's what derailed the thing, not the original comment. "Someone got offended" is the problem here. Not the alleged offender.

> they deserve all the bashing they are getting

How is this content? It's not even a jab, because they didn't say anything about Apple.

Re: Apple announces bug bounty program

#72
post #71

Earlier quoted context omitted.

Complaining about a poke at Apple is irrelevant. That's what derailed the thing, not the original comment. "Someone got offended" is the problem here. Not the alleged offender.

> they deserve all the bashing they are getting How is this content? It's not even a jab, because they didn't say anything about Apple.

Seems pretty simple to me:

There was a joke. It was at least tangentially related to the article at hand. Then someone got offended and made the very first irrelevant comment here. He could have just let it slide, but no.

More irrelevant comments were made in response to the first irrelevant comment. Yours included. I really don't think people care to read about your opinion on what ruins the site here.

Does it really matter? Are we going to continue talking about this or just let the vote buttons do the talking?

I bet you don't want to just let my comment hang here and you'll want to say something else that is completely not relevant to the article, but you're going to have to in order to stop this madness!

That's the struggle that every HN commenter must deal with.

You're not supposed to talk about your downvote (or upvote) and just do the voting. If you can't downvote yet, just leave it up to someone who can. Another strategy is to upvote sibling comments so they go higher than the comment that you hate. If it's really irrelevant it will die. But it's difficult, as you can see. So that's where mods come in.

Re: Apple announces bug bounty program

#73

Earlier quoted context omitted.

Getting sick of the Apple-bashing. Sad to see it has reached HN, I thought it was bad enough on Reddit.

I don't see the problem unless you think Apple gets bashed more than Microsoft or Google here. Do you think Apple gets more than Microsoft on HN? Please read any thread with Microsoft or one of their products in the title and you'll see M$ get bashed every single time. Google gets it too, from plenty of people. Anyway, they deserve everything they get. Each one of those companies have made large crowds of enemies for…

It's not a good joke because it's not original and is what you'd see in a YouTube comment. It's also not very funny because the premise of the joke, that Apple claims to invent things others already did never happens. Apple's presentations and PR communications are deliberate and rehearsed. If they do claim something in that vein, it's because it's either true or whatever the thing they claimed to have invented/innovated was sufficiently differentiated where a neutral third party would agree.

Usually when people make derivations of this "joke", what they're really responding to is that Apple is marketing or talking about something they did with their own take on it, and they just can't help themselves from pointing out that someone else did it first, even though the implementation may differ completely. The Touch ID sensor is one example that comes to mind.

Re: Apple announces bug bounty program

#74
post #66

Earlier quoted context omitted.

I haven't read the article, but I was at the announcement and your take is exactly how it was clarified in the room. If you do good work and report it, you'll get paid accordingly.

That setup doesn't make any sense to me. Either its an open program or a closed program. A closed program that allows submissions from others is an open program. What reasons what they have to do it this way? My first guess is to tick some checkbox.

It's pretty straightforward. Apple wants to start off slow, with a small group of people, and develop the quality of the program. By being explicitly closed, but implicitly open, they can focus their energy on the invited researchers, and ensure a high-level of support/response.

If they had explicitly said that it was an open program, they would have had to scale up their efforts to support the entire world of vulnerability researchers, or risk disappointing people for not responding quickly enough.

Put another way - if you are not part of the invited group, and you submit an issue, but do so poorly, or without a clear Proof-of-Concept, and concise description, you can reasonably expect to hear no response from Apple, with no grounds to complain that they ignored you. But, at the same time, if you have a clear exploit, well documented, with impact and proof-of-concept, then their is still an avenue to submit it to Apple, but it's up to Apple to decide how they wish to prioritize.

Re: Apple announces bug bounty program

#75
post #62
post #38

Earlier quoted context omitted.

The Reuters report has some details about why they limited it: >Apple said it decided to limit the scope of the program at the advice of other companies that have previously launched bounty programs. Those companies said that if they were to do it again, they would start by inviting a small list of researchers to join, then gradually open it up over time, according to Apple. Security analyst Rich Mogull said that lim…

Then it seems like a job to me, if it is, then they should pay a salary.

If it was a salaried job you would have to sign a Non-Disclosure, assign all intellectual property rights to Apple, ensure that you have good work attendance, be responsive to what your manager tells you to do, etc, etc...

I'm sure there are a lot of security researchers who would like to dabble in dozens of companies products, without being told what they had to do every day, yet still be compensated.

Re: Apple announces bug bounty program

#76
post #11

Earlier quoted context omitted.

From the article: > However, Apple won’t turn away new researchers if they provide useful disclosures, and plans to slowly expand the program. I'm reading this as: if you find a serious bug and report it, you'll get the money.

I imagine if you find a good bug and aren't on their list, you could bring in someone who is to help out...

... Or Apple could just be like every other bug bounty and pay out regardless of if you're on a white list or not.

Re: Apple announces bug bounty program

#77
post #73

Earlier quoted context omitted.

I don't see the problem unless you think Apple gets bashed more than Microsoft or Google here. Do you think Apple gets more than Microsoft on HN? Please read any thread with Microsoft or one of their products in the title and you'll see M$ get bashed every single time. Google gets it too, from plenty of people. Anyway, they deserve everything they get. Each one of those companies have made large crowds of enemies for…

It's not a good joke because it's not original and is what you'd see in a YouTube comment. It's also not very funny because the premise of the joke, that Apple claims to invent things others already did never happens. Apple's presentations and PR communications are deliberate and rehearsed. If they do claim something in that vein, it's because it's either true or whatever the thing they claimed to have invented/innov…

OK, well a joke doesn't have to be 100% accurate in every technical sense that you can think of for a lot of people to find it funny, like me.

The aura of smug that permeates Apple marketing and culture invites jokes like this. Whether you find it funny or not is completely irrelevant.

The main point here is that complaining about what you think is a bad joke is the thing that derails conversations here. Just vote and move along if you don't like it. What's so hard about that?

Of course, you can say that I should have just voted on your comment instead of responding but that's not quite the same thing because the subject has already been changed and this entire sub-thread is now about people getting offended about a jab made against poor little old Apple. Boo hoo.

Re: Apple announces bug bounty program

#78
post #52

Earlier quoted context omitted.

I don't understand how the deduction from giving X to a researcher and X to a charity is smarter than just giving X to the researcher?

Tax deduction for the researcher, not Apple (note the original GP was about "altruistic / independently wealthy researchers").

Hows donation of X for tax savings is better than 0.6X income?

Re: Apple announces bug bounty program

#79
post #73

Earlier quoted context omitted.

I don't see the problem unless you think Apple gets bashed more than Microsoft or Google here. Do you think Apple gets more than Microsoft on HN? Please read any thread with Microsoft or one of their products in the title and you'll see M$ get bashed every single time. Google gets it too, from plenty of people. Anyway, they deserve everything they get. Each one of those companies have made large crowds of enemies for…

It's not a good joke because it's not original and is what you'd see in a YouTube comment. It's also not very funny because the premise of the joke, that Apple claims to invent things others already did never happens. Apple's presentations and PR communications are deliberate and rehearsed. If they do claim something in that vein, it's because it's either true or whatever the thing they claimed to have invented/innov…

Nerd sniping[1] done right is what that was.

I'm always astonished how "religous" some people are towards defending their pet brands and take life so seriously. Obviously, offending people is/was not my intent.

Call it a joke or w/e you want, but I laughed; I'm sorry you didn't. Let me know if you'd like me to process a refund.

[1] http://xkcd.com/356/

Re: Apple announces bug bounty program

#80
post #71

Earlier quoted context omitted.

> they deserve all the bashing they are getting How is this content? It's not even a jab, because they didn't say anything about Apple.

Seems pretty simple to me: There was a joke. It was at least tangentially related to the article at hand. Then someone got offended and made the very first irrelevant comment here. He could have just let it slide, but no. More irrelevant comments were made in response to the first irrelevant comment. Yours included. I really don't think people care to read about your opinion on what ruins the site here. Does it reall…

Downvotes don't change anything. Only pointing out problems improves discussion. I am sorry this offends you.
Post reply on HN