Hacker News Reader

Comment by alt227 | Hacker News Reader

If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.

It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.

View on HN

It's important to not ignore the preexisting context before making these negative inferences. There was huge outcry that iOS exploits were being made and sold for millions of dollars each and white hats had no way to do their own research bc of Apple's behavior. So this was created to mollify that outcry. So it makes sense that you're required to report vulns and also required to not sell them to the highest bidder.

The entire security community uses and trusts the 90 day disclosure model. You are correct it it makes sense to report it to only Apple and not sell to the highest bidder. However it doesnt make sense to then muzzle that security researcher to never be able to disclose what they found to anybody else ever.

> So it makes sense that you're required to report vulns and also required to not sell them to the highest bidder.

Is Apple also required to fix them ? Because my impression was that Apple only fixes vulnerabilities _after_ they are exploited or _publicly_ reported.

The page only mentions that you're obligated to report it to them, not that you're not allowed to further publicize it (unless I missed something).

This is an important comment given the wild (though conceivable) speculations in other comments.

The subsequent sentence on the page also says that if you find a vulnerability in a third-party app you have to tell the third party.

"you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability."

https://security.apple.com/terms-and-conditions/

The entire sentence is:

> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.

Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.

The catch is, if you sign up to the Apple Security Research Device Program then every bug you find on that device has to submitted that way. Therefore if you choose to 'only forfeit the bounty' as you put it, then:

"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"

It’s not a violation of the terms to choose to forfeit the bounty in exchange for early disclosure. The terms explicitly allow that.

I mean, I’d assume that’s the case regardless of the wording. They’re giving you a device on a repeating lease. If you piss them off (ie release publicly when they’re not ready, regardless of who’s at fault for screwing up the disclosure timing), then they’ll take their toys away in a huff.

> until after

Entirely reasonable.

They can report it but have to wait until it’s fixed.

I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.

How about Googles head of security?

https://x.com/benhawkes/status/1286021329246801921

I’m not detecting any anger or complaining from this post. Maybe some disappointment. He’s saying they’re choosing to opt out in order to preserve their right to disclose.

> I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.

No, it's a way of making sure that Apple can fix the security issue and deliver the fix to customers before it can be exploited.

Or they won’t give you a device if your intention is not to share back any exploits? Is the expectation that Apple gifts black hats research devices?

> Apple gifts black hats research devices

this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool

The expectation is that Apple plays ball with the rest of the security community if they are expecting the security community to actually give them bug reports instead of selling them.

Paid bounties. Device program. Early access. How is Apple not "playing ball" here? Isn't that exactly what researchers asked for?

Apple has safeguards to avoid selling exploits to criminals that attack Apple's own customers. Good. I wouldn't want Apple to "play ball" like that.

Have you ignored all the conversation about the standard security industry 90 day disclosure period which the entire community is built on but apple refuses to use?

Why? If no one signs up then no one signs up. The people that do sign up play by those rules. No one is forcing them to apply to this program.

The program says they can’t disclose until it’s fixed.

How is that not playing ball?

This manufactured outrage is getting ridiculous.

> It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.

The text says they can’t disclose until after it’s fixed.

That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.

What if they never fix it? Is there at least a deadline where the researcher's are ungagged? What if the exploit is being used in the wild, can the researcher warn people then?

They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.

Probably both things are true.

Either way, consumers ultimately win in that the products and services they use will be made more secure.

> They also presumably don't want the exploits to fall into the wrong hands..

> Either way, consumers ultimately win

Except when the exploits fall into the _right_ hands. /s

Bribery applies to people in power or authority.

It’s not a ‘sneaky way of avoiding vulnerabilities going public’, it’s a responsible disclosure agreement between two consenting parties.

You make it sound like there’s something wrong with the conditions.

Is it really “sneaky” when the whole process, purpose of the SRD, and those requirements are clearly laid out on the front page?

First off, that's not true. Secondly, even if it were, it's not bribery - the only way to get the type of access the SRD offers is via this route, so it's an offer of specific terms for specific privileged access that is not otherwise available.

Its unconscionable that if you voluntarily sign up for a company's program you'll be bound by terms!

What’s the difference between bribery and a simple agreement? Secrecy?

One involves illegitimate benefits to someone in a position of power or authority.

Reply on news.ycombinator.com