[saagarjha]

I have no idea if Zerodium would pay out that much for this bug (probably not) or anyone else (maybe?) but Apple in general has a poor track record of paying out bug bounties. They do sometimes, but it seems like it is far rarer than their website says they should.

[dpkonofa]

>Apple in general has a poor track record of paying out bug bounties

What is this based on? My understanding is that Apple pays out 99% of the reported bug bounties and that's only because they include multiple submissions in the totals but not in the payouts (they only payout the first discovery or root discovery).

[smoldesu]

https://habr.com/en/post/579714/

thunderspy.io/

Those are my favorite recent examples, but specifically Apple has huge issues with turnaround time. They also don't communicate with or assist the researchers who found these exploits either, which makes things particularly frustrating for people who ultimately both want to secure Apple's systems. Their overt hostility, history of poor communication, and frankly pathetic bug bounties are all contributors to how people perceive Apple's relationship with security experts.

[dpkonofa]

You just posted the article that this whole thread is based on. You just posted the author's post instead of the blog's rewrite of it.

This makes it seem like this is a recurring problem yet there are only a handful of complaints.