This is all, indeed, a pretty shady business. I don't think there's anything authoritative we can say from the outside.
This is all, indeed, a pretty shady business. I don't think there's anything authoritative we can say from the outside.
How much is Zerodium charging people for these exploits if Apple isn’t paying?
Sure, they could stick the knife in if Craig Federeghi calls up to ask how much, but you’d assume it’s nothing to Apple to spin up an arms-length subsidiary with a folksy name to buy the info through.
I think we wrap ourselves in a bit of false security when we say something is open source and think that automatically makes it more secure. We assume someone has looked at the source. But has anyone really? And those with the most incentive to look into these things might not be inclined to share the vulnerabilities back to the community for safety's sake, given the princely sums being offered by companies like Zerodium.
Let that sink in...