Hacker News Reader

Hacker News

Comment by threatofrain | Hacker News Reader

Full thread

threatofrain

> 2020–05–16: Issue found

> 2020–05–24: PoC done and reported to Apple

> 2020–06–04: Catalina 10.15.6 Beta 4 with [hotfix released]

> 2020–07–15: Catalina 10.15.6 Update with hotfix released

View on HN

> 2021–03–30: Bug Bounty is still being evaluated

If Apple are actually serious, why are they taking so long to give the bounty? It's sounds like madness to me.

This is clearly what triggered the post.

Work was done but not paid. Shitty business on Apple side...

Those who fix the bug and those who issue payment are likely in two different groups with two different sets of motivators. Not excusing but explaining.

The company has billions of dollars. I don't think a $50k-$100k bug bounty payout for them is a big deal. Even $1m wouldn't be a big deal to them.

A company sufficiently large enough for such an amount to not be a big deal will have a money disbursal process nobody understands enough to make a one time transaction of that size in a reasonable amount of time.

Finance can always be subverted by management, but it has to be a priority.

Maybe a company so large it can’t track its own finances is too large to be responsible for its obligations and should be held to standards at least as strict as its less capable business and human peers. And I’m an Apple fan to be clear. But their wealth is the opposite of an excuse.

That's not an excuse. It's just a blunt explanation. Out of the ordinary processes can only proceed so quickly in the presence of massive bureaucracy.

It isn’t that finances aren’t tracked. They are tracked and audited and the audits are audited and there are many safeguards in place so that money doesn’t leak out and the knowledge for that operation is specialized, so much so that entire departments handle only part of the process and can’t just talk to one another due to the “segregation of duties” the auditors want. A company that decided to incentivize bug bounty like Google got support for the program on high and all the wheels of the org went to work to create policy, procedure, forms, auditor review, SARBOX compliance, etc and payouts will move like any other invoice. A company where some mid rank sees a need for such a program but doesn’t get full organizational alignment will be stuck with a pre-broken unreliable process.

That's still an organization that's too large or mismanaged to be trusted. We trust people who are capricious with their personal finances far less. A large organization with wealth impossible to humans but systems failing them and everyone else who depends on it... is a large corporation with wealth that has no excuse for not solving it.

The value of a bug isn't proportional to how much money the company has.

Why not? The potential damage certainly is proportional.

You state this confidently but I don't see why it's true a priori. I don't see a strong correlation between Apple's cash on hand, assets or market cap and the severity of a zero day in Mail.app.

The better comparison is active users, weighted according to how many apply automatic updates. The vulnerability half-life probably isn't as devastating as you might think it is since Apple has centralized control to push out updates, limited only by users deliberately not installing them.

I would consider a vulnerability in OpenSSH to be far more economically devastating, and there isn't even a company with a market cap behind that software.

Then I'm sure you can easily see why Apple having money matters. openssh users may be damaged and yet there isn't an apparatus in place to reward those who can provide value. What a shame, but who is confused?

Who is wondering why Patreon and a blog post isn't sufficient to facilitate value transfer in metaphorical openssh scenarios?

Your estimates of bug bounty money are orders of magnitude off.

Guess how much Microsoft pays for breaking the Windows Secure Boot implementation? $9k.

Reply on news.ycombinator.com