Hacker News Reader

Comment by kramerger | Hacker News Reader

Google has one of the best teams money and prestige can buy:

https://en.m.wikipedia.org/wiki/Project_Zero

They also have excellent collaboration with independent researchers across the world. But given how much software is written everyday, they can still miss some issues.

View on HN

Project Zero is amazing, but they 1) seem like a very small team, and 2) their mandate is far too broad (essentially to search for 0-days in anything, versus a specific system). What I am talking about is more like Apple having a dedicated team of 10 vulnerability researchers all looking into iOS 0-days fulltime.

They all do that. I've been in Offensive Security for 10+ years with several spent at FAANGS, and not only do they all have large security teams doing internal testing, they hire multiple contractors like Trail-of-Bits to audit every important service continuously throughout the year.

Apple has way more than 10 full time researchers looking at iOS all day, trust me :). They also have a really generous bug bounty. There is always bugs though.

> Apple has way more than 10 full time researchers looking at iOS all day.

Yes

> They also have a really generous bug bounty.

Hell no

Agree. Not long ago, Apple used to sue people reporting vulnerabilities to them. Imagine punishing people doing free work for you. Not a good look.

Getting punished is the default.

If you refer come across anything, keep your mouth shut.

Not only is it not generous (relatively speaking), but actually getting paid can be extremely annoying.

Used to be even worse.

Reply on news.ycombinator.com