Slashdot Mirror
Does Microsoft Need Bug Bounties?
Gunkerty Jeb writes "The threats and attacks may have changed in the last decade, but one thing has remained constant: software giant Microsoft doesn't pay for vulnerabilities. Never has. Never will. Even as rivals like Mozilla and Google have introduced bug bounty program, the Redmond giant has stuck doggedly with a position it articulated almost a decade ago, refusing to offer monetary rewards for information on software holes. But security experts say that position may have to change."
Even as rivals like Mozilla and Google have introduced bug bounty program, the Redmond Washington giant has stuck doggedly with a position it articulated almost a decade ago, refusing to offer monetary rewards for information on software holes. But security experts say that position may have to change.
Here is the source for Mozilla projects. Here is the source for Google Chrome. And where do I find Internet Explorer's source code? Oh, right. Well, I'm sure if they truly wanted my help making their browser better and more secure, they'd be okay with letting me take a peek at the source code. How can they start a bug bounty program when they won't even trust the community with seeing their code?
To put it another way: when you practice security through obscurity, offering monetary incentives for bug discovery is not a financially sound decision.
Furthermore, there have been times when a bug submitted to Google was deemed not a bug and a discussion ensued why that was with the source code referenced. I believe Microsoft could just say, "Oh, sorry, we don't owe you anything for discovering that feature but since you can't see the source code you'll have to take our word for it."
Microsoft doesn't need bug bounties. They need to achieve the prerequisite of code inspection before they can even consider putting their money where their mouth is.
My work here is dung.
Are you kidding? If Microsoft paid for every bug in Windows, they'd be bankrupt in a week!
paying out the nose, but that wouldn't be a terrible thing if it helped their products.
For conscience is the wound, and there's naught to staunch it
As many bugs as they have, it could put a dent in their profits.
make imaginary.friends COUNT=100 VISIBLE=false
Now why would they do that since they have their users paying for the right to use questionable software (using nice terms).
Frank
I was trying to submit a Windows 7 bug report last week and found it damn near impossible. It's like they would rather pay you to NOT submit bugs.
They are already paying for their bugs anyway...or at least their consumers are.
I can wish.
I would love to see both M$ and Sony complete liquidated.
If someone is passing you on the right, you are an asshole for driving in the wrong lane.
There is good money to be had selling discovered vulnerabilites. If you keep refusing to offer a bounty, they'll happily find someone else to pay for its discovery.
Feed the need: Digitaladdiction.net
The Six Dumbest Ideas in Computer Security
In Soviet Microsoft, you PAY them to report bugs.
No seriously, if you are a lowly person that found and confirmed a bug, you have to pay them to talk to them.
So yeah... Fuck Microsoft.
Vendors give away the vulnerabilities at no extra charge.
Whether they'll pay you to tell them where they are or not is the question.
Why pay bug bounties when you have a large backlog of unfixed bugs that were reported to you for free?
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
POKE781,96:SYS58251 makes my screen do funky things.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
But Microsoft could definitely use more Fletcher Christians and fewer Captain Blighs.
#DeleteChrome
Microsoft Bug Submission Form
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Since Microsoft has a habit of ignoring the issues that get reported without a bounty, I don't see how adding one would improve the issue.
One of the reasons for Full Disclosure is to pressure companies that think of security vulnerabilities as a PR problem instead of an urgent technical issue. If the first reaction you get from a company is "this only effects a small handful of users" then they are trying to patch through spin instead of fixing the problem. Microsoft is not the only one that does this, but they have been one of the biggest offenders.
BTW, "this only effects a small handful of users" has been used by Microsoft so many times that they have grounds to trademark the phrase.
"Trademarks are the heraldry of the new feudalism."
What if, instead of Microsoft sponsoring bounties for bugs in Microsoft code, we all just started a pool ourselves to fund a bounty for Microsoft coders?
It doesn't cost that much, surely someone must know a guy who knows a guy?
Clearly, since we can't fix the bugs ourselves, the most efficient solution is to make sure no more bugs can be introduced... Let's end the problem at it's source!
I think we should give Microsoft Time to work on Security venerabilities. As already by weeks the software updates have maxed hard drive space and performance is lowering. What is wrong is that the software originally is not made always secure of threats only accidents and patches that all.
People who find bugs in software say Microsoft should pay people who find bugs in their software. News at 11.
So long as Microsoft has a monopoly or heavy leverage in an area many of the bugs may benefit them:
Monopoly = "de-facto Standard"
Bugs = unpublished interface behaviour
= vendor lock-in.
This may be considered part of the reason MS has been a drag on the advancement of technology for at least a decade.
p.s. Gates' incredible philanthropy makes me more willing to forgive.
It's also a philosophical question. Microsoft as an organization believes that the best possible way of producing software is to hire the smartest programmers you can get your hands on, give them a carefully honed specification designed by the best marketing and UI people you can get their hands on, directed by the best management you can get their hands on, and have them go to work. And if you're Bill Gates, this really does seem like the right way to do business.
The trouble is:
1. You can't get your hands on all the smart people in the world.
2. Even if you could, enough people hammering at software in every way imaginable has a way of uncovering problems that the smart guys hadn't even thought of. I'm talking about stuff like "I didn't know that they were going to try to use some sort of wildly different equal sign Unicode code point from Cyrillic instead of a UTF-8 '='". That makes the population of users a much better source of uncovering obscure bugs than the best QA team could ever manage.
3. Linus's Law suggests that when somebody uncovers these sorts of obscure bugs, there's somebody in the world who could figure it out pretty easily. Using my earlier example, chances are that in the whole of Russia, there's somebody who really is interested in Unicode in a way that no sane person ever would be, and because of that developer's familiarity with Unicode and Cyrillic is going to have a good idea how to fix the bug in the best way possible. It may not be perfect right off the bat, but it will be started in the correct way because the person in question has the exact specialized knowledge needed to solve the problem. So the population of programmers not working for Microsoft is going to outperform Microsoft's programmers by sheer numbers if nothing else.
4. ESR pointed out that the guy in Russia interested in Unicode is far more motivated to fix a hypothetical Cyrillic Unicode bug than a programmer working in the bowels of Microsoft's headquarters, because it's a bug that affects them directly in a field they care about.
In other words, Microsoft can't win these kinds of fights, but they can't give up the belief that they can win these kinds of fights. Hence they won't change, no matter how much they should.
I am officially gone from
I can see the headlines now "M$ pays $4 million in bug bounties" compared to FireFox and Chrome. This would be every marketers nightmare.
Kurt Werle says:
"Microsoft may have to start paying users in order to stay relevant."
Now can we have a stupid article that quotes me?
Headline: "Should Microsoft pay its users?"
Because saying something stupid seems to be the bar for getting mention, here...
Microsoft's bugs are usually so nasty that they really need Brawnys instead of Bounties .
The real problem with Microsoft's Windows is support for Legacy Hardware and Software.
Microsoft Windows wan't designed to be secure in the first place. Even Windows NT-based OS's reintroduced legacy support for backward compatibility; a strategic blunder to pander the ultra-conservative developer base.
The Application Developer Base is refusing to adapt to new, secure API's like .NET, especially in the corporate sector, and is sticking to legacy API's like Win64, Win32 and even Win16.
Plugin Developers still program insecure ActiveX and NS-Plugins, as well as Toolbars.
Hardware Manufacturers are refusing to write drivers that adhere to the new security models.
The only way MS can make Windows secure is to do what it should have done with the introduction of WIndows NT and removed Legacy Support. It worked for Apple with Mac OS X and the "Classic" and "Rosetta" virtual machines. Microsoft are trying to do it with the Windows Ultimate "XP Mode", but failing.
They need to make the commitment and tell developers "If you don't do it our way, it won't work in Windows 8, or Windows 9, or whatever." They need to tell their Corporate customers, "If you're still running XP because of some stupid Legacy software, we're going to cut you loose next year. We won't be supporting you."
They don't think they can do this incase their customer base jumps ship to Mac or Linux. Even though it is a risk, they can because the majority of their user-base want Cheap Hardware and Easy-to-use Software, which rules out both Mac and LInux. They are locked into whatever Microsoft dictates.
It's more profitable to exploit a MS product vulnerability than filing a bug report and getting a few bucks.
Open Source Network Inventory for the masses! Kuwaiba
Divq zr nakvif fiz?
Enssvavreg vfg qre Ureetbgg nore obfunsg vfg re avpug. -- Nyoreg Rvafgrva
Ertanag cbchyv.
frzcre ra rkperghf
FRZCRE HOV FHO HOV!!!!
I believe that last one says, something about crying out for "Help" "Help", or calling out for "Security!" -- What language is this -- seems vaguely familiar... almost like when Dance Dance Revolution moves scroll up the screen, and I think: Holly Hell -- These Brainfuck coders have some messed up concepts of fun!
eEye Digital Security has been in business for over a decade. They started off finding vulnerabilities for MS products and then MS would pay them. That's how they made money. I should know, I worked there.
They may not have some contest or public announcement, but they definitely have paid for fixes before they go public.
Find a bug in Firefox or Chrome and you're helping make a product better that will make future products better.
Find a bug in IE and there is a likelihood that few people will ever use that code to make future products better.
The people who find many bugs are the people looking to find bugs and make products better. And they report those bugs along with reproducible steps.
The people who stumble upon bugs are trying to get other work done - they have no time or inclination to halt their work, figure out what they did to hit a bug, and report their findings (along with reproducible steps) to the IE team.
Be nice to your QA professional.
I don't care about bounties, how about a public bugtracker?