Hacker News Reader

Comment by AnonC | Hacker News Reader

> If you do not have a paid Apple Developer Account, please sign up at <our site>, pay the membership fee and send us the associated Developer ID.

You can’t make this stuff up! It’s completely and utterly ridiculous that even when you do get a bounty, they’ll take a cut from it. Leave aside the fact that some stingy hands found a way to devalue a person’s contributions to their platforms by offering a tiny fraction as a reward.

I didn’t understand the later parts of this post well, but the correspondence frequency and the way this has been handled is a mark of shame to all the information security folks working at Apple.

P.S.: I intentionally put <our site> instead of the actual link. That site doesn’t deserve to be linked in this context.

View on HN

> Once all steps are complete, we will reimburse you the cost of creating this account.

Seems they'll refund the paid account, still a weird thing to do.

They are saying, in effect, you must sign/agree to our 81-page developer agreement to receive the reward.

Lots of bug bounties are really just hush money, that you have to sign an NDA to get.

Always just publish your research. You can optionally offer it privately to the affected party in advance, but don't agree to any TOSes to do free work.

Full disclosure is responsible, too.

I assume lots of bug hunters (especially those from third world countries or those currently unemployed) depend on the bounty money to support their livelihoods.

This is why I think a third party bug bounty middleman service is inevitable. They will be better equipped to exact appropriate remuneration and develop relationships.

Companies should be trying really hard to avoid this happening by offering better rewards with less hoops to jump through.

Agree. It is a business opportunity. It will have to be a US based company as only those will have enough funding to both fight the legal fights and lobby for legal protection.

For the first few years the company will be considered a level just above common criminals. After a few while, they will be considered an essential consumer protection service.

That’s a bit like hitting the slots to support your family. Not only do you have slim chances to find anything that pays out a worthwhile sum, even if you do find such a bug they might come back with a “sorry, already reported”. If they get back to you, that is.

It’s not something to rely on at all.

Yep, you should really give up significant income from companies that do responsible vulnerability disclosure in the name of a random HN's commenter's values.

At no point did I say you should give up income.

"Always just publish your research."

In most bug bounty programs I've seen (including Apple's and Facebook's) payouts are contingent on not publishing the research without consent.

Any corporate is going to make you sign something to receive the cash. The terms would not normally be as strong as an NDA though, otherwise we wouldn't see any bounty reports.

> Once all steps are complete, we will reimburse you the cost of creating this account.

That literally sounds like a Nigerian email scam.

It is. But the subscription money is not the worst. You also have to agree to the terms of the developer account to open the account. Which means it will change the terms of your relationship with Apple before even getting any penny.

Maybe it’s their way of validating the identity of the person making the claim.

They have a mechanism to pay external developers, and they want to use that instead of creating a vulnerability-specific mechanism.

Everything about their platform is miserable. I'm so glad mobile Linux is starting to become usable and we finally have a real alternative.

I see this comment every year, for 15+ years that I’m active in the community, and yet I don’t see the promised hoards of Linux fanboys rioting on the streets wanting to burn down Redmond and 1 Infinite Loop.

Oh right, Linux on Desktop lost. Stop trying to make Linux on Desktop a thing.

Linux on the desktop is fine. 80% of Windows software runs carte-blanche, and the native ecosystem kinda embarrasses Microsoft's attempts at making Windows feel like a cohesive experience.

Of course, that's just my N+1 anecdata. I've been using Linux on my main PC for two years now without much issue, but ymmv.

as a windows user as my daily non-development driver unless that percentage hits 98%+ AND can maintain that I don't think many people are going to convert

I was with you 3 years ago, but Microsoft pushed a major update that caused random BSODs on my motherboards chipset. I switched over to Linux full time and haven't looked back, though to my knowledge the BSOD issue is still prevalent in Lenovo's Haswell prebuilts.

I have tried using Linux for desktop and just sucks. I just need something that works and something that I need to chase a xyz problem after an each upgrade.

I still chase these issues for server dist upgrades, but at least I don't have to do for my desktop.

Dependency management utterly sucks in Linux. I can still run windows 98 binaries on win10.

Running Win98 binaries is not a bragging point. I read archived diskmags through Wine, and all I need to do is double-click the .exe file to get it to boot up.

> I still chase these issues for server dist upgrades

Yeah, I don't doubt it. Full OS upgrades are always dangerous, as proven by the Windows 8 -> Windows 10 install fiasco or the Catalina wipes. LTS distros tend to get ~5-6 years of support though, so it's not like you're going to be forced to reinstall for another few years.

Linux, Windows and MacOS are all different flavors of the same shitshow. I can assure you that package/dependency management is not one of Linux's shortcomings, relative to it's competitors.

>Dependency management utterly sucks in Linux.

What the hell? That's one of the biggest things desktop Linux got really right! Sure older binaries don't work but you shouldn't be flinging binaries around anyway.

Linux is used as the primary OS for many developers, it has a market share comparable to OSX and Windows there. PopOS has made desktop Linux intuitive even for people who don't care what's running on their machine.

With Apple and Microsoft effectively abandoning their desktop OSes it's very likely that Linux will become the dominant desktop OS even among non-tech-literate users.

I think your hand slipped and replaced "I hope" with "it's very likely". Whether or not PopOS is intuitive is a separate question from whether or not Linux will dominate on the desktop.

Apple and Microsoft "abandoning" their desktop OSes is a dubious claim at best but in a magical world where they did, their "non-tech-literate users" wouldn't flock to Linux, they'd be happy they don't have to restart their computer for updates as often anymore. Non-techie people aren't going to move to a new OS except when they get a new computer. Even when they get a new computer they're just going to use the pre-installed OS. This is a fantasy.

These things have inertia. People who don't know computers aren't arbitrarily just going to decide to switch to a new OS where they have to relearn everything and their software doesn't work and there are moderately more driver incompatibilities that cause errors that confuse them. It's just not going to happen.

>Linux on Desktop lost.

All it had to do to "win" was be available to those who wanted it, which was the case. Mobile Linux is no different and in that sense it's definitely winning now.

> they’ll take a cut from it.

Did you just stop reading the post at the line you quoted, and came straight here to moan? They refund it. It's how they verify your identity and banking information.

Doubt it. This smells of lawyers. It’s how they get you to sign their agreement IMO.

They refund it at their choosing. It's a total joke. You shouldn't need to provide banking information to get compensation....

I'm just wondering, what would you prefer to be the method? Isn't providing banking info the least they need? To send the money?

He/She just want $18,000 in cash.

Okay. That would not even be possible in most of the EU. That's why I wondered. Some EU countries have limits on the maximum amount of cash transactions that can happen legally. Mostly between 3000-10000 euros allowed, depending on the country.

Issue a check? My whole point is you shouldn't have to pay money to "hopefully" receive money.

Hey, could you please review the site guidelines and stick to the rules when commenting on HN? I'm afraid you've broken them badly here, and also with https://news.ycombinator.com/item?id=27519724.

This particular comment would be just fine without the swipe. We're trying for a different sort of internet here, if possible.

I wonder if this will push some people to sell exploits on the black market instead.

Profit (creatively shielded from tax) above all. (Rotten) Apple.

What makes you believe Apple is unique in their avoidance in paying taxes?

Are you defending Apple by using the Whataboutism fallacy?

> Are you defending Apple by using the Whataboutism fallacy?

Pointing out that Apple follows the law, like every other company, isn’t whataboutism. In any event, Apple pays its taxes in America. The manoeuvres are on its foreign income.

you literally just described whataboutism.

'apple follows the law like every other'

you are saying 'but apple isnt the only one, whatabout'

when the companies get to make the laws, they dont also then get to hide behind them as a shield.

I agree that distorting focus is often a propaganda tool and diversionary tactic, but it goes both ways. Sometimes the category of problem really is larger and more widespread than the single cited instance, and it’s necessary and reasonable to see the forest rather than just the tree, particularly when the best solution applies to the forest as a whole; e.g. to close the widely exploited loopholes.

No. I’m saying you’re hating the fish that swim in a polluted stream. Apple, and Amazon, and Exxon-Mobil, and Goldman-Sachs, etc. all swim in those same poisonous waters. The stream is the problem.

No it's saying you shouldn't hate the polluting fish in the polluted stream just because other fish are bad too.

Where did they say that they believe Apple is unique in their avoidance of paying taxes?

Reply on news.ycombinator.com