Summary: Wired report is a $1M and Ars reports three, one at $2.5M - all paid by Zerodium. Wow.
Google, on the other hand, regularly pays white-hats something like $100k for "arbitrary access to contents of any Gmail content".
Beyond those buyers, the lines start to blur (defense contractors, companies in countries allied with the US e.g. FVEY). I would not recommend it either. Unethical buyers have completely different interests. I know Zerodium for one is a terrible place to sell to (you may be a target), and anything that is sold to Crowdfense is likely to be used against American interests.
My take away advice is, you can choose between painting a target on your front or one on your back.
Or rather that when i cross the wrong broader in to the wrong country that i might disappear?
ZDI, on the other hand can say: "We want $10M for this iOS zero day, or we don't report it to you." And the process of negotiation goes back and forth, but the end result is, Apple will pay considerably more to ZDI than through the direct program.
It's as if they are vetting for the most authoritarian, human-rights-abusing, anti-free-press countries in the list. A peculiar vetting process indeed
Question: How would you solve the Trolley problem?
Answer: By using more trolleys.
Apple has never made such a statement.
From the article:
> Apple said: “Security researchers agree iPhone is the safest, most secure consumer mobile device on the market.”
You are imagining that computer security is absolute. A system cannot be 100% secure or 100% insecure. To claim either is obviously false.
Systems can be relatively more or less secure than other system.
Saying they claimed their phones to be secure is just a lie.
It is a claim of relative security but it is a lie to say that Apple claimed their device is secure.
>The average reader would not interpret that statement as you did
I think most people can read the statement for what it is - a comparison to other devices on the market.
Also rather stupid was Apple's statement about their phones being secure, when its obvious there are zero days being sold to NSO instead of telling Apple. Everything is insecure these days, at some level.
If NSO paid people $1M for a zero day (I bet they don't say), and Apple/Google/etc paid $10K, who do you think gets the info.