Hacker News Reader

Comment by eamann | Hacker News Reader

Apple has a bug bounty program where they'll legitimately pay you to report bugs directly to them. What's with everyone reporting them to Twitter instead and forgoing the extra cash?

View on HN

People post on twitter because it actually gets a quick response. According to Lemi Orhan Ergin, the root password bug had been reported to directly to Apple five days before his tweet, but there was no response/fix. Then he tweeted about it, and it was fixed the next day.

https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo...

There's a case to be made for public shaming, sometimes. You're leaving it up to Apple to decide whether they want to pay you or not; they might deny the bounty for some reason, while still fixing the bug. Now you get nothing, in addition to having given Apple time to sweep the issue under the carpet and bury it under a change-log with language that heavily downplays the severity (e.g. "CVE - A buffer overflow could cause an application window behind the lockscreen to retain focus".

Posting it on Twitter, however, draws attention to Apple's waning security practices and how such glaring holes manage to slip past their peer review. It sparks public outrage, and may serve as a wake-up call to the company.

the bounties are low. and registering to those things require some loss of anonymity before you do get paid.

those are users dogfooding a product they paid for. and probably well off already, so the twitter bragging rigths is more valuable than the loss of anonymity + $500.

Submitting a bug bounty takes time. Also, informing people of security issues can be a virtue which is its own reward.

This doesn't seem like it would qualify under their categories. Not to mention, their bug bounty program info is nowhere to be found. I see tech sites reporting that they offer one but nothing on any apple site.

Reply on news.ycombinator.com