<story><title>Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone</title><url>https://www.forbes.com/sites/thomasbrewster/2019/08/08/apple-confirms-1-million-reward-for-hackers-who-find-serious-iphone-vulnerabilities/#7b31cc2d3948</url></story><parent_chain><item><author>H8crilA</author><text>I&amp;#x27;m surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it&amp;#x27;s really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices.&lt;p&gt;You can do so much damage&amp;#x2F;return with an exploit that affects &amp;gt; 30% of the population. Get 5 of those and sky is the limit.</text></item><item><author>devin</author><text>Apple salaries aren’t much of a secret, see: levels.fyi.&lt;p&gt;1M is a lot of money to me, a regular person, but when you consider that top security engineering talent could be making north of 500k in total compensation, 1M suddenly doesn’t seem all that impressive.&lt;p&gt;It’s a good bet to make on their risk. Imagine paying a mere 1M to avoid a public fiasco where all of your users get owned.&lt;p&gt;This just seems like good business. They could make it 5M, and it would still be worth it to them in the medium to long term.</text></item></parent_chain><comment><author>raxxorrax</author><text>&amp;gt; I&amp;#x27;m surprised by how cheap the vulnerabilities market is&lt;p&gt;I think this has a lot to do with government agencies buying any exploit they can get their hands and there is basically no market besides that. I don&amp;#x27;t know if that is illegal in the US, but it seems that government is the only buyer.</text></comment>
<story><title>Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone</title><url>https://www.forbes.com/sites/thomasbrewster/2019/08/08/apple-confirms-1-million-reward-for-hackers-who-find-serious-iphone-vulnerabilities/#7b31cc2d3948</url></story><parent_chain><item><author>H8crilA</author><text>I&amp;#x27;m surprised by how cheap the vulnerabilities market is. A good exploit, against a popular product like Chrome, selling for 100k or even $1M may sound like a lot, but it&amp;#x27;s really pennies for any top software firm. And $1M is still a lot for a vulnerability by market prices.&lt;p&gt;You can do so much damage&amp;#x2F;return with an exploit that affects &amp;gt; 30% of the population. Get 5 of those and sky is the limit.</text></item><item><author>devin</author><text>Apple salaries aren’t much of a secret, see: levels.fyi.&lt;p&gt;1M is a lot of money to me, a regular person, but when you consider that top security engineering talent could be making north of 500k in total compensation, 1M suddenly doesn’t seem all that impressive.&lt;p&gt;It’s a good bet to make on their risk. Imagine paying a mere 1M to avoid a public fiasco where all of your users get owned.&lt;p&gt;This just seems like good business. They could make it 5M, and it would still be worth it to them in the medium to long term.</text></item></parent_chain><comment><author>throwaway3627</author><text>It depends on how an exploit is monetized; the devils is in the terms: exclusivity, duration, scope and level of access. A non-exclusively-licensed exploit that can be sold 50x for $50k&amp;#x2F;year is bank ($2.5m&amp;#x2F;yr). If I were to spend 6-9 months developing a good exploit, I wouldn&amp;#x27;t give it Apple if and only if money were the primary and sole motivation. However, it makes sense to blog about it, turn it in to Apple and leverage such a discovery into outside Angel funding for a startup... that is if Apple doesn&amp;#x27;t require onerous NDAs. If the terms from Apple weren&amp;#x27;t favorable (they&amp;#x27;re likely to be terrible), then reselling it makes sense if you were really broke or going nonprofit security disclosure route at least parlays it into  cred.</text></comment>