Slashdot Mirror
More Than 10% of Mozilla Bug Finders Refuse Cash
angry tapir writes "The open-source Mozilla project has been offering cash bounties for security bugs for six years now, but often bug finders simply turn down the cash. Between 10 percent and 15 percent of the serious security bugs reported since Mozilla launched its bug bounty program have been provided free of charge, according to Mozilla."
More evidence, if any were needed, that "Open Source" software is a sinister communist plot that defies all sound economic principles.
Sincerely,
S. Ballmer.
Another nail in the coffin of socialism. Cash is the ultimate motivator.
There was a bug in the bug submit form. I couldn't check off the box at the bottom that said "Wants Cash".
Does that form work in Netscape?
And their subliminal programing.
Mit der Dummheit kämpfen Götter selbst vergebens
If one were to find the bug in the course of one's job, the employer may not allow you to accept a cash bounty. This is certainly the case in the US Federal Government, as well as many Federal Contractors.
"... often bug finders simply turn down the cash. Between 10 percent and 15 percent ..."
Not too sure what connotations "often" has for others but 10-15% doesn't really seem that "often"
"You see them trees out back, I take care of them. I'm a tree, I'm a tree wizard." - Crazy Homeless Guy
Some people may not be able to accept the bounty, and others may simply feel they have already gotten sufficient value (free browser!).
Though even those with altruistic motives would find it hard to turn down $3000.
Forget diamonds, copyright is forever.
I've helped out in projects which help the wider community but which are controlled in some way by organisations which I do not approve of. In such cases, I refuse to take anything but expenses. Benefitting from some organisation of which you disapprove is morally bankrupt, but helping out a good cause which happens to be promoted by that organisation is a fine act.
To do a bit of occupatio:
1. No, the effort in finding the bug isn't an expense, unless you're one of those consumer-citizen types who translates each hour into some cash value;
2. Something exists outside of its ownership. It is not inconsistent to judge that Firefox is good but the Mozilla Foundation is bad.
It's more often than one would expect. If I walked around handing out free cash, and 49% of people refused it (that is, less than 'may be called often' according to you), that is still much more often than most people would expected.
Finding bugs could be considered a job. If 10 to 15% of people don't expect to be paid for their work, wouldn't you agree that's significantly more than expected?
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report
https://developer.mozilla.org/en/Bug_writing_guidelines
The true geek will not take the money. They respect open source and want to help the open source community. Plus it's fun to find holes in software. No to mention firefox is such a great browser why not try and make it better.
http://www.thetechnologygeek.org
I have heard that the Nobel prize people will call and ask someone if they would accept the prize if it were offered them. If they say yes, then it's "Great! You have been offered a Noble Prize in %category%!". But if the potential winner indicates they are not really interested in material prizes, they just never offer the prize at all. That way they can say no one has ever turned down a Nobel.
I wonder if the Firefox people do the same thing in reverse. They would call the potential bounty winners (maybe just those in $1000+ range) and say something like "Hi there. This security bug you found might be worth a decent size bounty. If we offered it to you, would you actually take our money or or do something noble and selfless like allowing us to donate it? ". If the winner says they would probably just donate it, then it's all "Super! We will donate it! You're the best". If they take the money then it's "No problem. We offer you $50 for this.".
Of course I seriously doubt this happens at all. But it's fun to start vicious rumors about non-profits >:)
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
I'd say ~20% for often. 50%+ is "usualy" and over 75% can be "most of the time" with "nearly always" reserved for over 90%. So, depending on how you want to spin this, it can be "bug submitters nearly always accept cash," or "often times, bug submitters reject cash" (rounding 15% up to 20% for often-ness). But, as I noted in a previous post, the important thing is which way the numbers are trending, not necessarily what the numbers are, when determining how good news this is. The story title is actually pretty "fair and balanced" with how it frames it.
These guys are probably finding bugs in Mozilla to get laid. I know my wingmen and i have used that line to great success many times. You wouldn't believe how fast the ladies forget the fighter pilots, basketball players, and CIA agents at the bar when I tell them about a DOM parsing error i discovered!
To seal the deal i tell them i didn't want the money as i'm already super rich. Tomorrow i leave for africa to help impoverished children install Ubuntu.
What percentage of the individuals who find a bug are currently on work time? If 10% of found bugs are on work time then they may not be able to accept cash from another company while being paid by their current employer. Discovering a bug on work time just means you are doing your job.
...having not to use IE is priceless.
Some even find bugs and donate money to mozilla to keep preventing them from having to use IE.
I work in software, so do alot of my friends, a few of em also exclusively do bug finding. Guess how often one of them tells their employer they dont want their salary? Pretty sure 10-15% is often when it comes to a job.
insert funny sig here
... is because you'll have to pay more taxes and you don't want more money being used to kill Afghan civilians.
(That is if you live in a crappy country like the US).
How about a T-shirt that says "I found a Mozilla security bug" T-shirt that includes a GPG-signed copy of your name and the message from the Mozilla foundation.
Costs $10 for the Mozilla foundation, and is worth way more in bragging rights than a couple of hundred/thousand bucks.
Just sayin'
Dumb. Take the cash, donate it back, deduct it from your taxes.
Almost 90% of Mozilla Bug Finders Accept Cash Reward!
because they'd go broke
> If I walked around handing out free cash, and 49% of people refused it
> (that is, less than 'may be called often' according to you), that is still
> much more often than most people would expected.
In an old candid camera skit, someone tried that on TV. Had a wad of bills (today's value maybe $2), stood on a busy street corner, approaching passers by, waving a bill, saying "Fiver? Want a fiver? Here! Take a fiver! It's free!"
A vast majority of people gave him a wide berth and a dirty suspicious look - what category of a loon are you exactly?
I'll take uncut diamonds or bearer bonds.
Have gnu, will travel.
And Microsoft is a capitalist company!
They would never pay for bugs or patches or whatever.
They are leaders in a fierce competition field; they're the ones who get to charge for bugs, not the other way around!
Zealots! (8-[