If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
It's important to not ignore the preexisting context before making these negative inferences. There was huge outcry that iOS exploits were being made and sold for millions of dollars each and white hats had no way to do their own research bc of Apple's behavior. So this was created to mollify that outcry. So it makes sense that you're required to report vulns and also required to not sell them to the highest bidder.
The entire security community uses and trusts the 90 day disclosure model. You are correct it it makes sense to report it to only Apple and not sell to the highest bidder. However it doesnt make sense to then muzzle that security researcher to never be able to disclose what they found to anybody else ever.
"you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability."
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
The catch is, if you sign up to the Apple Security Research Device Program then every bug you find on that device has to submitted that way. Therefore if you choose to 'only forfeit the bounty' as you put it, then:
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
> It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
What if they never fix it? Is there at least a deadline where the researcher's are ungagged? What if the exploit is being used in the wild, can the researcher warn people then?
The expectation is that Apple plays ball with the rest of the security community if they are expecting the security community to actually give them bug reports instead of selling them.
Have you ignored all the conversation about the standard security industry 90 day disclosure period which the entire community is built on but apple refuses to use?
They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
Create a problem, and then heroically fight to make a solution.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
You can hack your iPhone all you want; it’s not illegal and Apple can’t stop you. People do it all the time.
Your complaint seems to be that Apple doesn’t make it easy for you. Why should they?
Apple does not insist they own all the iPhones. They ship a product configured how they want, just like every other consumer company. My Levi’s didn’t come with a sewing machine. My microwave oven doesn’t ship with a circuit diagram.
Products are made for their intended purpose. Once you buy one you can do what you want, but that doesn’t mean the manufacturer has to help you do it.
The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
> The fact so many technical people believe that security and freedom are mutually exclusive, and pay for that lie, is proof the Apple propaganda is working exactly as intended.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
Chromebooks had a screw you could remove on the motheboard to fully unlock them to do whatever you want. Something no one would do by accident. This was a reasonable solution from the less-evil Google days.
I've seen malware popups that give detailed steps on how to install the app on Android. You can put up all the scary warnings you want but if someone really wants to install some scam app, they will click past everything.
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
Which is why Google is getting ready to lock down Android.
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
> I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
Lumping consumer devices with the need for secure business devices and often offloading that to personal devices is the problem.
I wish they stop finding ways to lock down the device in the name of security and/or release different SKUs for the more secure use cases, provided by the organizations themselves if they deem it necessary.
Calling a phone a simple “consumer device” is a lot of hand waving. It’s my bank account, my access to a number of services, an identity provider, etc. I don’t trust myself to secure an open phone and I do this kind of thing for a living. It’s the asymmetric problem: I need to be right 24/7 forever, a bad actor only needs me to slip up once.
I do not even own a cell phone and have not for approaching a decade. I live a modern life as a founder and tech worker.
I have a house full of servers and self host virtually my entire digital life and even my own usage of AI, but when I leave home I typically carry no electronics at all.
We convince ourselves we need phones, but I promise you, they are optional. Being offline a few hours a day is also good for your brain.
It's true! The EU forced Apple to make it so you can install apps from third parties and every day iPhones are found haunted by malware! That's why root exploits only exist in Europe!
Well, except that one-click PDF persistent root exploit American researchers found, and there not being any sort of iOS malware wave in the EU.
"mutually exclusive" isn't a good way to think of it. "Tradeoffs" is much better.
iPhones are aimed at the many millions/billions of technically unsophisticated users who don't care about rooting their phone, but would be very unhappy to get phished out of their life savings.
Ah. So Apple -must- take freedoms away from everyone to install any software they want, to protect us. They could not possibly have a "format and void your warranty to unlock all features" switch on the motherboard like chromebooks have. Or the "get a one time warranty-voiding code from manufacturer" code like Samsung and other Android vendors have. Apple must make sure the path to freedom does not exist, for Grandma.
Grandma does not need the freedom to install the DeFlock or ICEBlock to help protect herself and her neighbors, right? Tim Cook is a Trump doner but of course has no political bias, and remains confident ICE and law enforcement always behave ethically so there is nothing to fear.
A corporation takes away basic freedoms of people over the tools they use to communicate with society, and then consumers get on the internet in public forums and -defend- them for it. Unbelievable.
I really hope you do not vote with this type of thinking.
Except “my Mac’s very secure and I can install whatever I want” is a complete fallacy. It isn’t secure - case in point Muse recently trawling through people’s messages. Or Mac cleaner like apps that trick users into installing them and giving liberal access.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
It would be a piece of cake to create a device that can be permanently downgraded for the un-tech savvy. It would be interesting to see how many customers would voluntarily choose that mode. My guess is that it would once and for all put Apple's security theater into the graveyard of stupid, annoying, and patronizing ideas where it in my opinion belongs.
Security and freedom are mutually exclusive for the vast majority of non-technical people who will happily infect themselves over and over with malware.
In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that. And not in the sense that it’s theoretically secure, I mean in the practical sense that I cannot trust my parents to use any currently available “free” device and not immediately load it up with malware.
> In my case, it is the fact that a secure and free (as in speech) alternative does not exist that leads me to believe that.
I don't think that is a logical statement.
Just something doesn't exist, does not prove that it can't exist.
You need a stronger proof than that to show that in my opinion.
At some point, you have to empower your users and trust them to do the right thing.
>I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
You need to have a stronger argument than "it has never existed and doesn't exist now, but it MIGHT exist IN THEORY". That's an enormously weak argument. Borderline dishonest really.
By definition, it could be more secure if people actually would be able to inspect it. Is it regardless the most secure? Hard to say. GrapheneOS is quite secure, probably more.
GrapeheneOS are both operating systems where a single party has the signing keys to run any software they want on your device at any time, and even remotely brick it.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
The difference between GrapheneOS and iOS is that it is 100% open source, replicable, able to self-sign, and only <1% of the part has dynamic code loading, which is incredibly low compared to any major OS.
You are still having to trust a pile of binary blobs even if you built and self signed every release yourself, which I used to do, but at 240gb of source code it is not practical for most individuals even if you do trust all those dozens of blobs from random vendors, which I do not.
This one is not really a fault of GrapheneOS, and more a reality that Android is not actually an open platform and never will be. I require a lot more control of a device I need to be able to trust than anything in the android ecosystem can offer anymore.
Replicant was the right approach but sadly never got the resources to pursue it at the required scale to support new devices.
I've covered that in the second part of my comment, even if you deliberately exclude GrapheneOS (not sure why you would as it's used by high profile targets), Apple still isn't #1
> Payment infrastructures demand tamper proofing for devices that handle payments
It wasn't that long ago that my bank's app had its own NFC payment feature that worked perfectly fine on a rooted phone. Unfortunately, they killed that feature and moved to Google Wallet.
As it turns out, payment infrastructure only requires tamper proofing if that's part of the arbitrary requirements of the app you're using.
This is also why my current Macbook will be my last, I'm going back to Linux. No matter how superior M-series chips are the amazing hardware can't make up for the unbearable nanny software. So tired of Apple machines telling me what I should do. It's supposed to be the other way around.
Almost every employer in my career ignored that I want to choose my hardware, and gave me a macbook, and I got them to compromise by giving me a pass to run whatever software I wanted. Every time I installed Linux on it, sometimes porting it myself with custom patches, on their time.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
They have windows they're open for every year, someone usually submits one during the window, I suspect. I submitted this in case anyone would find it useful, given the window is closing soon.
Israel can probably pwn any normal mobile phone because they invested a lot in this area, and has no reason to be afraid to do it. They are always shielded from consequences.
Lol is this a joke? So you are leased a device to find vulnerabilities, that you can’t report anywhere but to apple? Mostly for free?! Why would anyone do that? If I found one sure i will give sometime to the vendor to patch it out of courtesy, then I will publish my own results, I own it, no one works for free, touch some grass, apple.
> any vulnerabilities that you discover with the SRD are automatically considered for Apple Security Bounty — including bonus awards for preview and beta software programs.
Did you read the linked page? Any vuln you find with the device, you can report and receive the bounty you would’ve received otherwise. The idea of the SRD is that you can focus on bugs that you’d otherwise need to build a whole exploit chain just to get to.
The only issue is Apple doesnt follow normal 90 day public disclosure procedures, so if you enter into this program you are contractually obliged not to tell anybody but Apple about any security issue you find until they fix it. If they choose not to fix it (as they regularly do with these bugs) then you are never allowed to tell anybody about it under NDA. Many security researchers consider this a restrictive muzzle and so do not join the program.
Here is an example from a security expert from when the program originally launched:
> Many security researchers consider this a restrictive muzzle and so do not join the program.
And many researchers still do. Apple doesn’t care about those who don’t participate.
The point was never to make all security researchers happy.
You’re coming across as though Apple (or anyone else) owes you a duty and that you need to be made personally satisfied, and it’s incredibly off-putting.
Yes that's exactly my point, the phrasing of that is that nothing is guaranteed just "will be considered" but regardless they own your work, even if they considered and ultimately gave it no importance or just silently fixed it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
No, it's a way of making sure that Apple can fix the security issue and deliver the fix to customers before it can be exploited.
The subsequent sentence on the page also says that if you find a vulnerability in a third-party app you have to tell the third party.
https://security.apple.com/terms-and-conditions/
> For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
Which does not have the meaning of prohibiting disclosure to third parties or the public; it only means that you forfeit the bounty.
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
Entirely reasonable.
They can report it but have to wait until it’s fixed.
I think anyone angry about this is just looking for reasons to be angry. I also doubt the people complaining the loudest are even the targets of this program.
The text says they can’t disclose until after it’s fixed.
That’s reasonable. Calling this sneaky bribery and leaving out the fact that the agreement is only to wait until it’s fixed is really distorting the facts for maximum outrage.
How is that not playing ball?
This manufactured outrage is getting ridiculous.
Apple has safeguards to avoid selling exploits to criminals that attack Apple's own customers. Good. I wouldn't want Apple to "play ball" like that.
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
It’s not a ‘sneaky way of avoiding vulnerabilities going public’, it’s a responsible disclosure agreement between two consenting parties.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
This shouldn't exist in the first place. There would be no need for it if Apple didn't insist on "we own all the iPhones, our users just get to tap at them".
If you could just unlock the bootloader, re-enable SWD and do what you want with an iPhone that you actually own, there would be no need for this restrictive program at all.
Your complaint seems to be that Apple doesn’t make it easy for you. Why should they?
Apple does not insist they own all the iPhones. They ship a product configured how they want, just like every other consumer company. My Levi’s didn’t come with a sewing machine. My microwave oven doesn’t ship with a circuit diagram.
Products are made for their intended purpose. Once you buy one you can do what you want, but that doesn’t mean the manufacturer has to help you do it.
My Aunt Millie's iPhone is secure against herself because she can't install random garbage off the Internet and is in a walled garden.
As someone who works in IT: users are often their (and their organization's) own worst enemy. We've tried training and blacklisting (with anti-virus) for decades, and it appears that whitelisting and locking things down is what actually works.
I'd be happy with a 'compromise' where there's a factory reset where you can install your own code but it blows an e-fuse to indicate that device is no longer 'OEM certified secure' state.
I really wish we could have a simple "don't bother me, I know what I'm doing" switch on these phones but I can certainly understand the reasons why Apple and Google are putting in as many roadblocks as possible to protect users from themselves.
I wouldn’t mind phones having “Adult” mode that intentionally fails secure net and is completely split off from the standard user space. In adult mode I install what I want.
You just described what Samsung does with their phones. You can unlock them, but even if you later switch back to the normal OS, some features are permanently disabled by that fuse.
I wish they stop finding ways to lock down the device in the name of security and/or release different SKUs for the more secure use cases, provided by the organizations themselves if they deem it necessary.
I have a house full of servers and self host virtually my entire digital life and even my own usage of AI, but when I leave home I typically carry no electronics at all.
We convince ourselves we need phones, but I promise you, they are optional. Being offline a few hours a day is also good for your brain.
Well, except that one-click PDF persistent root exploit American researchers found, and there not being any sort of iOS malware wave in the EU.
iPhones are aimed at the many millions/billions of technically unsophisticated users who don't care about rooting their phone, but would be very unhappy to get phished out of their life savings.
Grandma does not need the freedom to install the DeFlock or ICEBlock to help protect herself and her neighbors, right? Tim Cook is a Trump doner but of course has no political bias, and remains confident ICE and law enforcement always behave ethically so there is nothing to fear.
A corporation takes away basic freedoms of people over the tools they use to communicate with society, and then consumers get on the internet in public forums and -defend- them for it. Unbelievable.
I really hope you do not vote with this type of thinking.
I think if you don’t get the point of protecting a device against the user, you’ve not had to help un-tech savvy relatives get out of situations where dark or confusing UI practices have got themselves into a mess.
I don't think that is a logical statement. Just something doesn't exist, does not prove that it can't exist. You need a stronger proof than that to show that in my opinion. At some point, you have to empower your users and trust them to do the right thing.
Let me expand the claim to include the caveats:
>The fact so many technical people believe that security and freedom are mutually exclusive [under current technological/financial/political constraints]
>At some point, you have to empower your users and trust them to do the right thing.
All I know is, my and my parents’ quality of life is far better after switching them to devices where they are not empowered.
Given how many high profile politicians, journalists and businessmen have gotten their phones hacked, the iPhone is not unhackable.
This is a silly argument to make. By pretty much any standard, the iPhone has really good security.
Anyone know if those exploit(s) worked on iPhones with Lockdown Mode enabled?
* https://support.apple.com/en-ca/105120
* https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a...
The "no root access, no bootloader unlock, no installing your own Apple-unapproved software" bullshit is mandated by Apple, with no opt-out.
I for one am not comfortable with anyone having that much power over something that is supposed to be mine, so they are the same to me. Untrustable black boxes.
This one is not really a fault of GrapheneOS, and more a reality that Android is not actually an open platform and never will be. I require a lot more control of a device I need to be able to trust than anything in the android ecosystem can offer anymore.
Replicant was the right approach but sadly never got the resources to pursue it at the required scale to support new devices.
And if you only take into account stock phones, stock Pixels are still above it as per exploit costs.
So they are basically 3rd or 4th place if you add some other Android flagships into the list.
Graphene is iOS
What problem are you trying to "solve"?
It wasn't that long ago that my bank's app had its own NFC payment feature that worked perfectly fine on a rooted phone. Unfortunately, they killed that feature and moved to Google Wallet.
As it turns out, payment infrastructure only requires tamper proofing if that's part of the arbitrary requirements of the app you're using.
The greatest middle finger to Apple is freeing their hardware. Been at it since I built and booted a uCLinux kernel on my first iPod I got as a kid.
Do not fall for it. Publish everything publicly after appropriate embargo periods.
There are some really ridiculous attempts to be outraged about this program.
https://news.ycombinator.com/item?id=23919175
Did you read the linked page? Any vuln you find with the device, you can report and receive the bounty you would’ve received otherwise. The idea of the SRD is that you can focus on bugs that you’d otherwise need to build a whole exploit chain just to get to.
Here is an example from a security expert from when the program originally launched:
https://x.com/benhawkes/status/1286021329246801921
And many researchers still do. Apple doesn’t care about those who don’t participate.
The point was never to make all security researchers happy.
You’re coming across as though Apple (or anyone else) owes you a duty and that you need to be made personally satisfied, and it’s incredibly off-putting.