Apple refused to pay bounty to Kaspersky for uncovering vulnerability

Makes total sense to me.

"Oh, you can't pay because we are in Russia, just pay to our Massachusetts subsidiary!"

There’s a very real chance that headlines of the variety “Apple makes donation to charity to pay Russian hackers” float around. It’s not even wrong (though it lacks a lot of context).

I’m doubtful Kaspersky is even that mad about it; they knew they weren’t getting paid at the outset.

I knew dozens of people in my computer security career who'd "openly" been in technical branches of the (mostly US) military, or done classified work for defense contractors, or in a few cases who had worked for outright spy agencies (on what I do not know). Maybe a handful of them might have still been not-openly working for those agencies; most almost certainly were not.

Many of them were still obviously sympathetic to those agencies' agendas. That did not necessarily extend to helping them out in any way (although sometimes it definitely did). A few sure seemed exactly the opposite, and if they were in deep cover, they probably could have served that goal better by just keeping their mouths shut. In a few cases they helped to build organizational or technical structures that clearly would have made it harder for anybody, including the agencies they'd previously worked for, to subvert their new employers' security guarantees.

So, 35+ years ago, at 16, Kaspersky took what was probably the only technical education opportunity available to him in Soviet Russia(TM). At maybe 20, he took what was probably the only job available to him. Going by that same Wikipedia article, apparently within a year or two, he moved to private industry (such as it was in that place and time). That included getting an early release from military service (not sure how that interacted with the dissolution of the USSR, which happened at more or less the same time).

That's par for the course.

It is very, very hard to find a person or company in that space that's squeaky clean, has no conflicts of interest, and/or has no ties at all with any government or government agency you might be afraid of.

If it's a large company (bigger than Kaspersky), and has been around a while, there's a real chance that it's released products with all kinds of weird back doors, with and/or without the knowledge of its executive management. Maybe even back doors for multiple competing actors. And at the same time it may release many more products that don't have them.

I don't think Kaspersky (the man) is some kind of revolutionary, nor do I think Kaspersky (the company) is going to openly defy the Russian government. I also don't think that their trustworthiness couldn't change at any given time. I do think that they're at least averagely "good". And I think that they get way more than their share of paranoia, with tons of people just assuming that they've "always" done things with their products that, frankly, they couldn't realistically have gotten away with doing.

https://www.zdnet.com/article/log4j-chinese-regulators-suspe...

It is because you uncovered the backdoor, stupid. They worked hard to hide it. /s

Galov’s statement is plainly wrong. The very first line in Apple’s bug bounty program terms and conditions states that awards are granted solely at their exclusive discretion.

There is no “must.”

Those from the West who don't like the truth I'm saying - I am actually Russian, know my country better than you, and I DESPISE every American who supports our regime or just ready to deal with it like with some civilised entity. Fascist dictatorship you deal with has nothing but hatred towards your state and your nation. Every dollar you pay them will come back will to you in form of terror attacks and deaths of your people, directly of through proxy conflicts.

I'm sure during WWII there were anti-Nazi Germans who felt the same for example towards IBM, who had lucrative contracts with the system of concentration camps of Third Reich.