<story><title>Zero-Click Calendar invite vulnerability chain in macOS</title><url>https://mikko-kenttala.medium.com/zero-click-calendar-invite-critical-zero-click-vulnerability-chain-in-macos-a7a434fc887b</url></story><parent_chain><item><author>tptacek</author><text>Lots of comments on this thread about bounty payouts. If a tech giant with a standing bounty program isn&amp;#x27;t paying a bounty, the odds are very strong that there&amp;#x27;s a good reason for that. All of the incentives for these programs are to award bounties to legitimate submissions. This is a rare case where incentives actually align pretty nicely: companies stand up bounty programs to incentivize specific kinds of research; not paying out legitimate bounties works against that goal. Nobody on the vendor side is spending their own money. The sums involved are not meaningful to the company. Generally, the team members running the program are actually incentivized to pay out &lt;i&gt;more&lt;/i&gt; bounties, not less.</text></item></parent_chain><comment><author>bakztfutur3</author><text>No, it&amp;#x27;s because Apple&amp;#x27;s &amp;#x27;product security&amp;#x27; team that investigates and pays out bug bounties is horribly mismanaged and ineffective. It was recently moved from the SWE program office to SEAR (security engineering &amp;amp; arch), and the manager was recently shown the door and went to AirBNB. The team members are mostly new college grads (ICT2&amp;#x27;s and 3&amp;#x27;s) who wouldn&amp;#x27;t pass a coding interview elsewhere in the company, and mostly function as bug triagers. They spend more time going to conferences and hanging out with hackers, than in front of a computer screen working. Their portal of &amp;#x27;open investigations&amp;#x27; shows a graph that only goes up (aka they only get more swamped with emails and don&amp;#x27;t even try to catch up).&lt;p&gt;Shaming Ivan, the head of SEAR, on Twitter is how people who should get paid bounties, but aren&amp;#x27;t, make progress.</text></comment>
<story><title>Zero-Click Calendar invite vulnerability chain in macOS</title><url>https://mikko-kenttala.medium.com/zero-click-calendar-invite-critical-zero-click-vulnerability-chain-in-macos-a7a434fc887b</url></story><parent_chain><item><author>tptacek</author><text>Lots of comments on this thread about bounty payouts. If a tech giant with a standing bounty program isn&amp;#x27;t paying a bounty, the odds are very strong that there&amp;#x27;s a good reason for that. All of the incentives for these programs are to award bounties to legitimate submissions. This is a rare case where incentives actually align pretty nicely: companies stand up bounty programs to incentivize specific kinds of research; not paying out legitimate bounties works against that goal. Nobody on the vendor side is spending their own money. The sums involved are not meaningful to the company. Generally, the team members running the program are actually incentivized to pay out &lt;i&gt;more&lt;/i&gt; bounties, not less.</text></item></parent_chain><comment><author>saghm</author><text>Unless the implication is that the author of this point is misrepresenting things, I&amp;#x27;m struggling to think of what &amp;quot;very good reason&amp;quot; there could be when there&amp;#x27;s a clear record of someone reporting a bug well before it&amp;#x27;s fixed. At best, it seems like typical slow bureaucracy, which I don&amp;#x27;t think is a particularly good reason. There&amp;#x27;s no reason it should take over a year for someone to approve something like this if the company actually incentivized it. Your logic might be sound, but it&amp;#x27;s hard for me to look at a situation like this and think &amp;quot;company is either stingy or overly bureaucratic like companies overwhelmingly tend to be in almost every other circumstance&amp;quot; is less likely than &amp;quot;company has legitimate reason not to pay out a bounty that ostensibly has been fulfilled&amp;quot;. It just seems way more plausible that the incentives that happen pretty much everywhere else have bled into this domain, assuming the author is accurately describing the events.</text></comment>