If you sign up to this program and use one of their devices for 'research', then you are bound by contract to report any security bugs to them and only them (unless the bug is in a 3rd party app). I see this as a pretty sneaky way of avoiding your security vulnerabilities going public and all the bad media exposure that goes along with it.
It is giving security researchers something they have always wanted in return for their silence. Another way to put it is bribery.
Or they won’t give you a device if your intention is not to share back any exploits? Is the expectation that Apple gifts black hats research devices?
> Apple gifts black hats research devices
this is the unintended consequence that whoever came up with this policy missed: it effectively leaves only bad actors in your pool
The page only mentions that you're obligated to report it to them, not that you're not allowed to further publicize it (unless I missed something).
They also presumably don't want the exploits to fall into the wrong hands.. which might be a slightly less nefarious and equally plausible interpretation of the program.
Probably both things are true.
Either way, consumers ultimately win in that the products and services they use will be made more secure.
What’s the difference between bribery and a simple agreement? Secrecy?