We Hacked Apple for 3 Months
Bug bounties have always been mispriced. Either the damage estimates for a given bug are wildly over-estimated by risk analysts, or the price paid to find them is based on some kind of stupidity-arbitrage play. I think it&#x27;s the latter.<p>Consulting firms bill between $1500-$2500&#x2F;day for senior staff. 2 hackers for 10 days could be the $50k they got paid. Instead, this crew used 5 hackers for say 45 days, or 225 person days. Napkin arithmetic suggests that&#x27;s somewhere between $240k and $560k.<p>I could say it&#x27;s consulting firms who are overpriced, as a group of amateurs will do better work for for -  of the cost, but over the years I&#x27;ve found that the difference in the security world is that you hire a small shop to discover the truth about risks, but you pay a big firm to lie about them. That&#x27;s what costs extra, and given their transparency maybe this work wasn&#x27;t mispriced at all.