a transparent bug bounty system

The end result will be the same. You will call this a PR stunt.

This scenario is more of a lootbox/gambling — a chance to win a big prize, but no gaurantee. A proper bug bounty system would be a consistent outcome, and far more fair.

...Does anybody consider all the existing bug bounty programs "PR stunts"? You seem like you're fishing for a reason to continue disagreeing, and you're most certainly putting words into a stranger's mouth.

A bug bounty program would demonstrate a lot more sincerity around securing their devices than a one-off reward to a kid given simply because the kid got enough attention in the media.

No, many companies have an objective bug bounty system. No one is calling those payouts PR stunts.

Many companies have a public-facing bug bounty system.

It's incredibly rare for a company to have an objective bug bounty system. I would estimate that the number of companies like this is zero. (Source: I have worked triaging reports to public bug bounty systems for large companies that you've heard of. Payouts can differ by thousands of dollars based on factors like your prior history reporting to the program, what the triager chose to put in their report (even if your two reports are identical), or the label you put on the vulnerability you're reporting.)

Perhaps. Although couldn't that just be because we're all so used to corporations having no real accountability and only occasionally deciding to make symbolic gestures as penance for their mistakes? You're probably right that, to many of us, they can't really do anything to make up for this. But that's not our problem. It's theirs.

This is a very easy problem. If you feel this strongly stop buying their products. If you don't do that clearly you don't feel strongly enough. Blaming them when they do the right thing is just going to discourage them to do so in the future

I've never bought an Apple product, but I can still be bothered by the fact that such huge corporations exist and can completely change random people's lives if they choose to.

I don't understand this thread.

The article only says: "[Apple] said it would compensate the Thompson family and make an additional gift toward 14-year-old Grant’s education."

For all we know, they got a check for $250.

How do you reconcile your statement with the fact that you, yourself, can confer life-changing benefits to all sorts of people?

The teen and mother in question were not too technically savvy. Would they have been able to meet the usual requirements of a bug bounty filing?

The mother was a lawyer who went as far as signing up for a developer account and filing a radar. They could (and did) jump through hoops to try to report it.

What about others ?