... how about Google pays more for bug bounty. How about Google actually pays people who report bugs/vulnerabilities. How about Google hires talent that actively tests, discovers and mitigates vulnerabilities rather than pushing that responsibility off on "the community" for considerably less pay. You know: "ownership."
There's no "obligation" to report, other than ethics and integrity. That's it. Further, there still exists no obligation for companies to report vulnerabilities as CVEs.
> How about Google actually pays people who report bugs/vulnerabilities.
That's exactly what Google did. They paid the person who reported it and not discovered it. You can just follow the issue comments to get all your answers.
> So why is Google pushing a presser about Apple "not reporting a zero day"
Exactly. So why is Google pushing a presser about Apple "not reporting a zero day" when they have a team (Project Zero) dedicated to discovery of zero days? Is it really that Apple employee's responsibility, or is it Google Project Zero employee's responsibility?
The best you can do is say Google says "this issue was reported by sisu from CTF team HXP and discovered by a member of Apple Security Engineering and Architecture (SEAR) during HXP CTF 2022, which will be acknowledged in the security fix notes for the appropriate Stable channel release at the time they are updated" [1] which really is a nothingburger.
This is apple we're talking about. Some times magnificent, other (most?) times unable to get out of its own way, especially when it doesn't have a process for X. And anything that involves saying anything in public...
Obviously they think their silos of secrecy are a net positive, but really I wonder. I do consider them the greatest, or one of the greatest execution machines in business, but I also think that's despite themselves.
I'm confused. Are you suggesting that having a team dedicated to discovering zero days means that this team will discover all zero days that could possibly exist?
Or even, that they will discover all zero days that will be discovered before anyone else discovers them?
There's no "obligation" to report, other than ethics and integrity. That's it. Further, there still exists no obligation for companies to report vulnerabilities as CVEs.