Hacker News Reader

Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.

If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.

Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will.

It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.

“probably fine” is not the comment I would’ve wanted from my lawyer. There are tons of ways this could’ve gone south. For example, which charity? What if Kaspersky benefited from a tax break as a result. Etc. etc. why take a chance?

Reply on news.ycombinator.com