From the article:

>However, Apple won’t turn away new researchers if they provide useful disclosures, and plans to slowly expand the program.

I'm reading this as: if you find a serious bug and report it, you'll get the money.

I haven't read the article, but I was at the announcement and your take is exactly how it was clarified in the room.

If you do good work and report it, you'll get paid accordingly.

That setup doesn't make any sense to me.

Either its an open program or a closed program.

A closed program that allows submissions from others is an open program.

What reasons what they have to do it this way? My first guess is to tick some checkbox.

It's pretty straightforward. Apple wants to start off slow, with a small group of people, and develop the quality of the program. By being explicitly closed, but implicitly open, they can focus their energy on the invited researchers, and ensure a high-level of support/response.

If they had explicitly said that it was an open program, they would have had to scale up their efforts to support the entire world of vulnerability researchers, or risk disappointing people for not responding quickly enough.

Put another way - if you are not part of the invited group, and you submit an issue, but do so poorly, or without a clear Proof-of-Concept, and concise description, you can reasonably expect to hear no response from Apple, with no grounds to complain that they ignored you. But, at the same time, if you have a clear exploit, well documented, with impact and proof-of-concept, then their is still an avenue to submit it to Apple, but it's up to Apple to decide how they wish to prioritize.

> Put another way - if you are not part of the invited group, and you submit an issue, but do so poorly, or without a clear Proof-of-Concept, and concise description, you can reasonably expect to hear no response from Apple, with no grounds to complain that they ignored you. But, at the same time, if you have a clear exploit, well documented, with impact and proof-of-concept, then their is still an avenue to submit it to Apple, but it's up to Apple to decide how they wish to prioritize.

Thanks, that does make a lot of sense.

My main exposure to bug bounty programs has been through the blog post of submitters, that don't give much insight to the resources/support that e.g. Apple would need to give.

The actual effort is pretty minimal - 2-3 FTEs for a closed bounty program, plus maybe another 15-20 FTEs or so to assist with triage once it's opened up - total cost for Apple to set up a bug bounty is on the order of $5million/year staffing. Its more the trying to scale up so you don't end up annoying people by not being responsive - it takes time to hire the people and train them.

>That setup doesn't make any sense to me. Either its an open program or a closed program.

Or it's something in between. Few things in life are or have to be binary -- that's a very CS mindset.

Apple wants to start it as closed, so they have full discretion as to what "others" they will accept (since they've already said they're not just accepting anybody).

This helps them build up their teams and infrastructure for it with the fewer, pre-selected, people, and gives them time to expand (or even evaluate if they need expanding to fully open anyway, perhaps a smaller/controlled list works well enough too).

At the same time, the "we might accept non-invited third parties" gives them the opportunity not to miss out on any important unexpected collaborators / bugs.

I read that as: if you find a bug and report it, you may get invited into the formal bug bounty program (but may not get a payout on the first one).

No idea if that's right though.

The Reuters report has some details about why they limited it:

>Apple said it decided to limit the scope of the program at the advice of other companies that have previously launched bounty programs.

Those companies said that if they were to do it again, they would start by inviting a small list of researchers to join, then gradually open it up over time, according to Apple.

Security analyst Rich Mogull said that limiting participation would save Apple from dealing with a deluge of "low-value" bug reports.

"Fully open programs can definitely take a lot of resources to manage," he said.

http://www.reuters.com/article/us-cyber-blackhat-apple-idUSK...

True, but it's not like Apple doesn't have the resources to manage an open submission program.

They may have financial resources but I doubt their security engineers would want to deal with the deluge.

It's not about throwing money or people at a problem, it's the overhead that lowers its efficiency and agility.

Maybe they want to invest cautiously. Seems smart to me.

If it was a salaried job you would have to sign a Non-Disclosure, assign all intellectual property rights to Apple, ensure that you have good work attendance, be responsive to what your manager tells you to do, etc, etc...

I'm sure there are a lot of security researchers who would like to dabble in dozens of companies products, without being told what they had to do every day, yet still be compensated.

I imagine if you find a good bug and aren't on their list, you could bring in someone who is to help out...

... Or Apple could just be like every other bug bounty and pay out regardless of if you're on a white list or not.

Someone's always willing to pay.

It just might be in bitcoin on some .onion site :)