If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
It's important to not ignore the preexisting context before making these negative inferences. There was huge outcry that iOS exploits were being made and sold for millions of dollars each and white hats had no way to do their own research bc of Apple's behavior. So this was created to mollify that outcry. So it makes sense that you're required to report vulns and also required to not sell them to the highest bidder.
The entire security community uses and trusts the 90 day disclosure model. You are correct it it makes sense to report it to only Apple and not sell to the highest bidder. However it doesnt make sense to then muzzle that security researcher to never be able to disclose what they found to anybody else ever.
"you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability."
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
The catch is, if you sign up to the Apple Security Research Device Program then every bug you find on that device has to submitted that way. Therefore if you choose to 'only forfeit the bounty' as you put it, then:
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
I mean, I’d assume that’s the case regardless of the wording. They’re giving you a device on a repeating lease. If you piss them off (ie release publicly when they’re not ready, regardless of who’s at fault for screwing up the disclosure timing), then they’ll take their toys away in a huff.
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
I’m not detecting any anger or complaining from this post. Maybe some disappointment. He’s saying they’re choosing to opt out in order to preserve their right to disclose.
The expectation is that Apple plays ball with the rest of the security community if they are expecting the security community to actually give them bug reports instead of selling them.
Have you ignored all the conversation about the standard security industry 90 day disclosure period which the entire community is built on but apple refuses to use?
> It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
What if they never fix it? Is there at least a deadline where the researcher's are ungagged? What if the exploit is being used in the wild, can the researcher warn people then?
They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
First off, that's not true. Secondly, even if it were, it's not bribery - the only way to get the type of access the SRD offers is via this route, so it's an offer of specific terms for specific privileged access that is not otherwise available.
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
> The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
Chromebooks had a screw you could remove on the motheboard to fully unlock them to do whatever you want. Something no one would do by accident. This was a reasonable solution from the less-evil Google days.
I've seen malware popups that give detailed steps on how to install the app on Android. You can put up all the scary warnings you want but if someone really wants to install some scam app, they will click past everything.
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
Which is why Google is getting ready to lock down Android.
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
> I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
alt227 22 hours ago
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
halJordan 16 hours ago
alt227 16 hours ago
Fraterkes 19 hours ago
gumby 17 hours ago
The subsequent sentence on the page also says that if you find a vulnerability in a third-party app you have to tell the third party.
alt227 16 hours ago
https://security.apple.com/terms-and-conditions/
wtallis 15 hours ago
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
alt227 14 hours ago
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
scratcheee 54 minutes ago
otterley 8 hours ago
Aurornis 13 hours ago
Entirely reasonable.
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
alt227 9 hours ago
https://x.com/benhawkes/status/1286021329246801921
otterley 8 hours ago
pizlonator 14 hours ago
No, it's a way of making sure that Apple can fix the security issue and deliver the fix to customers before it can be exploited.
gehsty 19 hours ago
alt227 16 hours ago
pixl97 13 hours ago
Aurornis 13 hours ago
How is that not playing ball?
This manufactured outrage is getting ridiculous.
schiffern 15 hours ago
Apple has safeguards to avoid selling exploits to criminals that attack Apple's own customers. Good. I wouldn't want Apple to "play ball" like that.
alt227 14 hours ago
jareklupinski 19 hours ago
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
Aurornis 13 hours ago
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
kevincox 13 hours ago
giwook 20 hours ago
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
greggsy 14 hours ago
It’s not a ‘sneaky way of avoiding vulnerabilities going public’, it’s a responsible disclosure agreement between two consenting parties.
otterley 13 hours ago
runjake 13 hours ago
sneak 5 hours ago
theoreticalmal 20 hours ago
greggsy 14 hours ago
turtlesdown11 14 hours ago
ACCount39 1 day ago
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
orf 1 day ago
lrvick 23 hours ago
throw0101a 20 hours ago
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
lrvick 13 hours ago
wildzzz 14 hours ago
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
999900000999 14 hours ago
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
a022311 19 hours ago
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.