Slashdot Mirror
More Than 10% of Mozilla Bug Finders Refuse Cash
angry tapir writes "The open-source Mozilla project has been offering cash bounties for security bugs for six years now, but often bug finders simply turn down the cash. Between 10 percent and 15 percent of the serious security bugs reported since Mozilla launched its bug bounty program have been provided free of charge, according to Mozilla."
More evidence, if any were needed, that "Open Source" software is a sinister communist plot that defies all sound economic principles.
Sincerely,
S. Ballmer.
Another nail in the coffin of socialism. Cash is the ultimate motivator.
There was a bug in the bug submit form. I couldn't check off the box at the bottom that said "Wants Cash".
Does that form work in Netscape?
And their subliminal programing.
Mit der Dummheit kämpfen Götter selbst vergebens
If one were to find the bug in the course of one's job, the employer may not allow you to accept a cash bounty. This is certainly the case in the US Federal Government, as well as many Federal Contractors.
"... often bug finders simply turn down the cash. Between 10 percent and 15 percent ..."
Not too sure what connotations "often" has for others but 10-15% doesn't really seem that "often"
"You see them trees out back, I take care of them. I'm a tree, I'm a tree wizard." - Crazy Homeless Guy
"Between 10 percent and 15 percent" is not often in my math books. More than 50% may be considered often. Btw the latest 3.6.8 FireFox I have installed is a crash fest for me and crashes several time per day, without extensive surfing.
Some people may not be able to accept the bounty, and others may simply feel they have already gotten sufficient value (free browser!).
Though even those with altruistic motives would find it hard to turn down $3000.
Forget diamonds, copyright is forever.
I've helped out in projects which help the wider community but which are controlled in some way by organisations which I do not approve of. In such cases, I refuse to take anything but expenses. Benefitting from some organisation of which you disapprove is morally bankrupt, but helping out a good cause which happens to be promoted by that organisation is a fine act.
To do a bit of occupatio:
1. No, the effort in finding the bug isn't an expense, unless you're one of those consumer-citizen types who translates each hour into some cash value;
2. Something exists outside of its ownership. It is not inconsistent to judge that Firefox is good but the Mozilla Foundation is bad.
The true geek will not take the money. They respect open source and want to help the open source community. Plus it's fun to find holes in software. No to mention firefox is such a great browser why not try and make it better.
http://www.thetechnologygeek.org
I have heard that the Nobel prize people will call and ask someone if they would accept the prize if it were offered them. If they say yes, then it's "Great! You have been offered a Noble Prize in %category%!". But if the potential winner indicates they are not really interested in material prizes, they just never offer the prize at all. That way they can say no one has ever turned down a Nobel.
I wonder if the Firefox people do the same thing in reverse. They would call the potential bounty winners (maybe just those in $1000+ range) and say something like "Hi there. This security bug you found might be worth a decent size bounty. If we offered it to you, would you actually take our money or or do something noble and selfless like allowing us to donate it? ". If the winner says they would probably just donate it, then it's all "Super! We will donate it! You're the best". If they take the money then it's "No problem. We offer you $50 for this.".
Of course I seriously doubt this happens at all. But it's fun to start vicious rumors about non-profits >:)
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
These guys are probably finding bugs in Mozilla to get laid. I know my wingmen and i have used that line to great success many times. You wouldn't believe how fast the ladies forget the fighter pilots, basketball players, and CIA agents at the bar when I tell them about a DOM parsing error i discovered!
To seal the deal i tell them i didn't want the money as i'm already super rich. Tomorrow i leave for africa to help impoverished children install Ubuntu.
What percentage of the individuals who find a bug are currently on work time? If 10% of found bugs are on work time then they may not be able to accept cash from another company while being paid by their current employer. Discovering a bug on work time just means you are doing your job.
...having not to use IE is priceless.
Some even find bugs and donate money to mozilla to keep preventing them from having to use IE.
I'm a Systems Administrator.
You offer me money, I'm taking it.
You offer me enough money, maybe I don't delete the porn that you stashed on the network storage.
(What? I learned from the best. All glory to the Bastard.)
... is because you'll have to pay more taxes and you don't want more money being used to kill Afghan civilians.
(That is if you live in a crappy country like the US).
How about a T-shirt that says "I found a Mozilla security bug" T-shirt that includes a GPG-signed copy of your name and the message from the Mozilla foundation.
Costs $10 for the Mozilla foundation, and is worth way more in bragging rights than a couple of hundred/thousand bucks.
Just sayin'
Dumb. Take the cash, donate it back, deduct it from your taxes.
Almost 90% of Mozilla Bug Finders Accept Cash Reward!
because they'd go broke
I'll take uncut diamonds or bearer bonds.
Have gnu, will travel.
And Microsoft is a capitalist company!
They would never pay for bugs or patches or whatever.
They are leaders in a fierce competition field; they're the ones who get to charge for bugs, not the other way around!
Zealots! (8-[