Hacker News Reader

Comment by ewagsjr | Hacker News Reader

Ya, if I interpreted this right, also really convenient that they seem to be dragging their feet on a $100,000 bounty.

Nobody's going to pay $100,000 for a bug that lets you download someone's contact list.

How much would a bug like that be worth? I can imagine getting anyone's contact list being valuable.

Why? What would be valuable about that? Specifically, what would be valuable about getting someone's GameCenter contacts? These aren't business or family contacts. These are people the person games with. It's a privacy violating bug but not a show-stopping bug. Important but not valuable.

You're misunderstanding the vulnerability. The bug is in gamed, the Game Center daemon, but it allows access to the entire CoreDuet database, which does on-device intelligence stuff. Duet essentially logs everything you do on your phone, which means that if you look at the database it'll contain logs for all your interactions, not just those with Game Center contacts.

You are correct. I did misunderstand that portion of it but that doesn't change the fact that Apple is willing to pay $100k for a bounty like that but no one else does and Apple's actions don't suggest at all that they won't pay out the bounty. If you've ever been part of a program like this, on the developer side, it's possible that they discovered a larger bug that this was a part of or that someone else had already reported this bug. Tracking down the origin of this and the tickets involved takes time and fixing the bug is always the priority. They haven't acknowledged that he's the originator of the report so his insistence that he be credited immediately is a big immature and premature.

There's nothing here that suggests Zerodium, or someone similar, would pay the same amount Apple is offering and there's nothing that suggests that Apple doesn't intend to pay this or credit him. That's all completely conjecture.

I have no idea if Zerodium would pay out that much for this bug (probably not) or anyone else (maybe?) but Apple in general has a poor track record of paying out bug bounties. They do sometimes, but it seems like it is far rarer than their website says they should.

>Apple in general has a poor track record of paying out bug bounties

What is this based on? My understanding is that Apple pays out 99% of the reported bug bounties and that's only because they include multiple submissions in the totals but not in the payouts (they only payout the first discovery or root discovery).

https://habr.com/en/post/579714/

thunderspy.io/

Those are my favorite recent examples, but specifically Apple has huge issues with turnaround time. They also don't communicate with or assist the researchers who found these exploits either, which makes things particularly frustrating for people who ultimately both want to secure Apple's systems. Their overt hostility, history of poor communication, and frankly pathetic bug bounties are all contributors to how people perceive Apple's relationship with security experts.

You just posted the article that this whole thread is based on. You just posted the author's post instead of the blog's rewrite of it.

This makes it seem like this is a recurring problem yet there are only a handful of complaints.

Reply on news.ycombinator.com