<story><title>Zero click vulnerability in Apple’s macOS Mail</title><url>https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c</url></story><parent_chain><item><author>philosopher1234</author><text>I like this idea.&lt;p&gt;1. Company verifies the bug&lt;p&gt;2. Assigns it a price according to impact&lt;p&gt;3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access.&lt;p&gt;Different bug markets can compete to correctly price bugs.</text></item><item><author>Zhenya</author><text>It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn&amp;#x27;t paid out.&lt;p&gt;Maybe a good business is bug escrow company.</text></item></parent_chain><comment><author>fractionalhare</author><text>In all likelihood, Apple would just refuse to play ball and tell them to go ahead and sell it to someone else if they&amp;#x27;re so confident. Zerodium and other markets already exist, and I don&amp;#x27;t think people at Apple lose much sleep over it. And you better hope you close that deal before Google Project Zero finds it independently and tells Apple for free. Plus the mere mention that a vulnerability exists in a specific piece of software may lead Apple engineers to finding and patching it before you can sell it. Give away too many details and it&amp;#x27;s burned.&lt;p&gt;People tend to vastly overestimate the economic impact of an exploited security vulnerability. A vulnerability which can be patched in a centralized manner has a low value half-life: it rapidly decreases in value over time. I would guess over 90% of active daily users of macOS already have the patch for this bug due to automatic updates. New buyers are essentially guaranteed not to have the vulnerability at all. The vulnerability would have to be absolutely catastrophic to be worth something, and in that case it would probably be used for targeted exploitation and burned after a short period of time.&lt;p&gt;Contrast with something like heartbleed, which is still around. That is a vulnerability with serious half-life and significant economic impact. The pool of available victims who can be exploited by heartbleed is nontrivial and persistent years later. Criminals will actually pay for something like that.</text></comment>
<story><title>Zero click vulnerability in Apple’s macOS Mail</title><url>https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c</url></story><parent_chain><item><author>philosopher1234</author><text>I like this idea.&lt;p&gt;1. Company verifies the bug&lt;p&gt;2. Assigns it a price according to impact&lt;p&gt;3. Keeps details hidden until Apple pays them, then reveals the bug. Thus Apple is forced to pay, but bad actors dont get access.&lt;p&gt;Different bug markets can compete to correctly price bugs.</text></item><item><author>Zhenya</author><text>It seems backwards that Apple acknowledges the issue, PATCHES it, but still hasn&amp;#x27;t paid out.&lt;p&gt;Maybe a good business is bug escrow company.</text></item></parent_chain><comment><author>twox2</author><text>Bug bounty doesn&amp;#x27;t mean that the reporter is selling the bug they find for a reward. It&amp;#x27;s a gesture of gratitude from the company. This whole conversation is coming from a place of entitlement.</text></comment>