Slashdot Mirror
Mozilla Starts Bug Bounty Program
AnamanFan writes "The Mozilla Foundation announced the Mozilla Security Bug Bounty Program, an initiative that rewards users who identify and report security vulnerabilities in the open source project's software. Sponsered by Linspire, Inc and Mark Shuttleworth, the program will give $500 to users who report a significant bug in Mozilla software. Users who identify security bugs in Mozilla software are encouraged to go to the Security Projects Page for more information."
if microsoft did this they go bankrupt in a week
obligatory jab at microsoft
30% Troll, 50% Underrated, 10% Interesting
Score:5, Troll
mozilla.org offers a $500 bounty for discovering "critical" security holes, while Mircosoft offers a $250,000 bounty for catching virus authors.
I think this is a great idea, and that it will help mozilla become a lot more secure (and pretty fast I might add)
A few days ago you might remember someone who created an article on the vunribilities of a fake browser being made in a empty window using XUL...
:)
Guess he's 500 dolars down for blowing the whistle a week early
Microsoft puts bounty $5,000 on head of anyone uncovering IE security flaws.
Cause we could go ahead and program ourselves a couple new minivans this evening ;) (yes I know Wally from Dilbert said it before I did, but this just seemed like the perfect time to use it)
This will give all budding CS majors (and lazy security geeks) a reason to hunt for bugs, other than being inquisitive.
With the first link, the chain is forged.
Imagine if /. paid a nickle for every 503 error.
Oliver's army is here to stay Oliver's army are on their way And I would rather be anywhere else But here today
...but doesn't this sound a bit desperate? IF Microsoft did this, people would be singing from the halls that Microsoft has given in, or getting desperate. (And alot of people would be rich).
All credit to the Mozilla Foundation if they can keep their image with this kind of approch to secuirty.
Now, who's going to be the first to earn their $500?
NeoThermic
Use my link above, or to view my server, NeoThermic.com
Instead they have a $10 million dollar pool of rewards for the capture of people who exploit the bugs for malicious purposes.
I think the saying 'an ounce of prevention is worth a pound of cure' is applicable here.
Micro$oft gives out millions of dollars to catch people who exploit bugs in their browser! Now Linux gives out cash directly to people who find the bugs, rewarding engineers instead of snitches. I hope the major news outlets cover the huge difference in paradigm here- good cop instead of bad cop.
Everyone failed my last Gmail invite challenge, and I'm up to three invites, so here's a new one: there are sixteen factual errors in this article. I'll give you one for free: Bush is not a downhiller! Spot them all for a Gmail invite.
-Exmet
If guns kill people, then CmdrTaco's keyboard misspells words.
If you've ever won any money at a charity fund-raiser, you know the deal:
1) go up and accept your check
2) nod and smile alot
3) donate your check back to the charity
Is there a prayer people motivated by this bounty have the same modicum of class?
It may help the "budding CS majors" to build code analysis and debugging skills. Debugging skills are not taught in school.
Fight Spammers!
This seems like it could become rather popular, after all people like money. Will the developers at mozilla all of a sudden find themselves with bugs that aren't?
Don't get me wrong I think this is a great idea, and as others have said it should really spur on the tightening of security for the browser.
Will we all learn Reki's lesson one day?
Until fairly recently, Netscape used to have a similar bug bounty program but they offered $1000. So it's really just a continuation of the legacy.
1. Submit buggy software to Mozilla project.
2. "Find" said bug.
3. Profit!
Maybe it's just me, but I really am wondering why they're doing this. Mozilla is *full* of bugs already, many of them significant (albeit not security-related), that aren't fixed; and users that encounter security issues are likely to report them anyway, I think, no matter whether they get paid for it or not.
quidquid latine dictum sit altum videtur.
It is no secret that Mr. Linspire still has not paid for the Project B of his XBOX bounty.
8 month after the deadline...
So do you really expect that he will pay the Mozilla money?
the irony is sickening (to the tune of $70bn vs a "non-profit org")
What if Slashdot gave $503 for every 503 Service Unavailable?
Malda and company would be living off ramen and store-brand Mountain Dew in less than a week.
Cretin - a powerful and flexible CD reencoder
why did I submit those bugs in the past :(((
I've found a serious flaw in Mozilla. It allows itself to run on Windows, an inherintly insecure platform.
Well.. maybe. Or Maybe not. But Definitely not sort of.
IIRC, Netscape had a bug bounty of sorts and it was pretty much ignored. There was a lot of annoyance from people reporting bugs to see them either never fixed or fixed and no one given credit for the bounty. (This was all pre-AOL buying Netscape.) I know the Mozilla foundation's different, but there's a lot of people with long memories and they'll need to be prepared to show they're different in this aspect too.
I remember saying to myself "If I had a nickel for every bug in (insert program name) I'd be rich". Remember, when you don't act on your ideas and file a patent, THIS happens. But I should tell MS to implement this idea. Note going broke should be a good motivation to fix their own security flaws.
quote: "Alright! I'm coding me a mini-van!"
Sig it.
Mozilla likes to do security through obsecurity. Dont believe me. Look through the bug reports, any of them that contain any type of security vulnerability and locked down and you are unable to view them. Whats up with that mozilla?
QED.
Dear pvt medic,
Thank-you for identifying this IE exploit! The FBI prize patrol should be by shortly with your reward!
Sincerely,
Bill Gates
Not trying to troll, but 0.9 is a shit release. 0.8 zipballs and installers can still be found with a little digging around the Firefox page.
...and get $500 for your effort, you may want to keep it (as opposed to donating it to charity or giving it back to the foundation, as others have suggested here) because you're going to need it when you get sued for your service to the community.
Thank you, DMCA and anything that protects big businesses which had their servers infect their customers' computers, but nobody got to know which businesses because they might lose money if their IT carelessness was made public.
1-Name your GNU/Linux distribution to sound familiar with an insecure operative system that owns 90% of the desktop market.
2-Win a few million dollars to settle out of court giving up the stupid name (which made the product feel inferior even if familiar).
3-Use this money to fund the software on your OS, making it even better then the one you wanted to sound like.
4-Profit? Forget profit, PRICELESS!
Is it a reference to Haibane?
The shareholder is always right.
I found a bug, my FrontPage 2003 web pages don't display correctly in Mozilla.
Also, notice that one is based on prevention, the other is based on punishment.
Which one you think is more efficient?
The $500 bounty is just marketing spin. It's not as bad as the BS "crack the code" contests spun by snake oil cryptographers, but a low bounty like this isn't going to attract new white-hatters.
Think about it...this story will headline in tech rags (including this one) for free. Even if Mozilla pays out a couple bounties (say $3000), they get the message that "Mozilla is secure" out there fast and cheaply.
On the other hand, for most of us in the security community, $500 is maybe a half-day of work. So...there isn't a whole lot in terms of risk/reward if you are primarily motivated by money.
Perhaps I've been living too long on a cynic world...
But defining what is "Significant bug" will be extremely important, since this is not an unbiased concept, who will decide what is significant or not? Certainly it will not be who reports the bug, but it shouldn't be the one that pays the bill either.
Long live TUX!
Lame joke, i'll admit. I happen to be a lover of lame jokes. The ppropriate response to such a joke is not laughter, but collective groan from the audince. I guess you post counts.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Using a debugger without knowing what you are looking for is virtually useless. One needs to apply scientific methods and smart tool related methods.
Fight Spammers!
So if I find a serious bug in Mozilla, they will pay me $500? So then that means all I need is $199 more to pay SCO to be able to use Linux with a more secure Firefox? YIPPIE!!
CowsAnonymous: We're here to help moo.
What happened to the open source axiom "with many eyes, all bugs are shallow"? Shouldn't it render a program like this unnecessary?
Hm, your sig indicates that you might be the first to collect the bounty, or does it mean something entirely different?
Employee of Inrupt, Project Release Manager and Community Manager for Solid
It's a heck of a lot cheaper than hiring testers or paying programmers to find bugs.
...the rendering bug I've had with Firefox since... well... forever! Only on Slashdot - for the disbelievers I've slapped a couple of screenshots up here. These are with the latest STABLE release, not a nightly bugfest, BTW...
Code, Hardware, stuff like that.
Unless applications are evaluated by some pro-consumer third party (something like Consumer's Union), it's not much of an offer. The proposed "bounty" gives the staff too much wiggle room.
<naiveté>Some might even conceivably make some sort of living at it, rather than writing exploits </naiveté>
As a reminder, Mark Shuttleworth is the Internet entrepreneur who was the second space tourist. It's really quite cool to see him taking an interest in helping Mozilla.
Since today it has not been possible to access slashdot.org with Mozilla 0.9.1 and cookies enabled
With cookies off the only problem is that you cannot login, moderate or metamoderate. That should save some time then....
The Mozilla Foundation isn't a charity -- they got a donation, and are going to use it. All the people that want to donate time and are already finding security bugs can already do so.
Speaking of which, $500 is probably a *lot* of money if you're working in certain countries.
Oh, and I'm hoping that the MF won't run into problems with people trying to scam the system by introducing security problems and then "discovering" them.
May we never see th
My favorite Spywares are not installing themself on my windows machine anymore, since all my password are stores in Gator, i posted as a Anonymous Coward...
Gimme my 500$!
Many worms spread using holes that are already publicly known at the time the worm is written.
The shareholder is always right.
I guess Mozilla is afraid now that holes are starting to be found in their browser too, proving that just moving to a new browser isn't the answer that everyone has been preaching.
Rather than have people find the holes and exploit them they figure "Why not try to pay the people who find them so they won't exploit them?" That's pretty lame!
Why not give up your lunch money while you're at it!!!!
+6 Insightful.
People already do make a living finding flaws in microsoft products. They are software testers and microsoft employs plenty of them. I'm sure they are making more than the equivalent of $500/ per bug.
I'd rather be lucky than good.
2) Report bug to bounty programme under alias 2
3) PR0FIT!!!
4) Repeat as necessary...
"Flyin' in just a sweet place,
Never been known to fail..."
I'm going to write me a new minivan this afternoon!
"It's really quite cool to see him taking an interest in helping Mozilla."
Getting SVG, SMIL, XForms, MathML, and complete CSS2 would be an asset.
That's the argument used by Microsoft to avoid announcing critical flaws before they're patched.
Given the fact that that XUL bug was know for, what, a year,
It was known since 1999 but was marked as "confidential." Very disappointing. I'm not sure why there's not more outcry over this.
Mozilla was the big-news, major OSS project. As it gets bigger, it's exhibiting the very signs that people profess to hate about Microsoft. It's interesting to see the tables turned.
The truth is that the "many eyes" idea doesn't actually work. It's not like coders sit there all night poring through the code line by line. People miss things in the code just like a company's developers miss things in their code. The Linux kernel has had plenty of system-killing bugs in its time, and Mozilla has already had several major critical flaws. What's particularly disturbing is that the XUL flaw was known since 1999 but marked "confidential."
What we're witnessing is an OSS project struggling to deal with catering to the ideologies that spawned it while coping with the actual realities of software development. As many of us have been saying all along, nothing is inherently more secure than anything else. It gets proven time and time again.
It's only a matter of time before someone steals their confidential list of security bugs and cashes in big time.
Software piracy is victimless theft.
To any Mozilla developers, I offer to share the bounty with you by "discovering" the bugs you may "accidently" create. Please contact. Thanks.
But yes, some bugs hang around for a loooooooooong time, but AFAIK some bugs dating from Windoze 95, or before, and still present, possibly in a slightly different form, have not been fixed yet. I was reminded of one yesterday, when Xtra Pathetic locked up because I had taken the CD out of the drive, not realising that some obscure window was still wanting to access files. That sort of problem was fixed in Linux ages ago, drives are locked (where possible) to ensure you unmount properly. But even there, some things are not getting fixed.....
Two things the software "industry" (including extremes such as the Criminal Monopoly, FOSS etc) have never been particularly good at are good quality, accurate documentation, and also prompt fixing of bugs which are not actually annoying the developers. I don't see any sign that it will change any time soon, people prefer to work on the most interesting bits..... There is much less excuse for large companies of course, they can afford to pay staff, set up QA systems and so on, yet it still does not get done, except in a few places such as IBM, Sun, Oracle..... Having said that, a few bits of FOSS documentation are first class, and high priority things which interest top developers do get fixed promptly, especially where security is concerned. But the stuff in the middle, which is neither free nor horrendously expensive (but still over-priced for what it is) is the worst of the lot.
Strangely, in the UK we once had Acorn Computers, who with one of their earlier products, the BBC Micro, managed to produce very good (but not quite perfect) documentation, and very good software with the few remaining bugs fully documented, and fixed when the next ROM was issued. Way ahead of M$ Basic of that era, and ran fater on the 2MHz 6502 than Bill's bloat did on a 6MHz PC-AT with floating point coprocessor. They repeated that feat with the next series of RISC machines, with early ARM processors, and so did the third-party software suppliers. For a very much smaller market than M$, decent word processors, drawing packages (such as the forerunner of the super-fast Xara for the PC) etc were all less than a quarter of the price of similar but buggier packages for the PC from, you know who. I never did understand how minority market software could be cheaper, less buggy, and in some cases more user-friendly than mass-market software, except to observe that Bill was not involved. Enough said about his negative contributions to computing and the world economy, I think.
Holy mary mother of god.
Let me guess -- you associate the word "charity" with well-meaning handouts that mainly benefit people who have lots of lame excuses for not working. There are charities like that, but that's not what the word means.