[vessenes]

Don’t love the bounty state here — security researchers, is it typical to wait this long with Apple or other FAANG type companies?

[tptacek]

Very yes.

[factormeta]

seems this just encourage researchers to sell zero-day exploits to organize crime and/or alphabet letter agencies. No wonder we have no digital security at all! Big tech don't really care about security or privacy. Why are we even using their stuff?

[tptacek]

It does not. Bounties and zero-day markets are different things. Lots of people actively sell to both.

[fsflover]

And you think this is fine?

[tptacek]

I do, yes.

[fsflover]

https://news.ycombinator.com/item?id=41546343