Slashdot Mirror
Microsoft To Pay $200k Prize For New Security Tech
Trailrunner7 writes "In the face of mounting external pressure to begin paying bug bounties, Microsoft is instead launching a new program that will pay a $200,000 top prize to a security researcher who develops the most innovative defensive security technology. The program is designed to 'inspire researchers to focus their talents on defensive technologies,' the company said. Known as the Blue Hat Prize, after the company's regular internal research conferences, the program will focus in its first year on getting researchers to design a novel runtime technology to defend against memory safety vulnerabilities. Microsoft security officials said that rather than paying for individual bugs the way that some other companies such as Google, Mozilla and others do, they wanted to encourage researchers to think about ways to defeat entire classes of bugs."
Awesome! That'll pay for 15 graduate students!
If I develop something capable of winning this prize, I'm productizing it and making Microsoft pay for EULAs for it. That'll net me a lot more than $200k just from them, and more from everyone else.
And that's all I have to say about that.
Wire hooked up from the USB port delivers a 5 volt shock when user clicks on a malware site.
I'm not a lawyer, but I play one on the Internet. Blog
Linus Torvalds just opened a new bank account.
Wouldn't it be awesome if RedHat won the Blue Hat prize.
A 5 volt shock... yeah, that'll teach 'em!
If they persist, fetch the dreaded 9 volt batteries from the armoury!
Trolling is a art,
It's pocket change for Microsoft, but high enough to attract real interest. And $200,000 is just the beginning. Microsoft will make a very lucrative offer to whomever innovates at that level.
Wire hooked up from the USB port delivers a 5 volt shock when user clicks on a malware site.
I've always preferred positive over negative reinforcement.
Whenever a player quits EVE to go play WoW, the Average IQ of both games increase.
So every time you click on a non-malware site, then.... what?
"to defend against memory safety vulnerabilities"
Funny that they are restricting peoples talents like this. There may be better ways to defend against malware than this, which I don't think they are trying to defend against. It seems like this type of defensive vector might be more geared to DRM/TPM.
A whoosh sound plays over the speakers.
So every time you click on a non-malware site, then.... what?
your computer gives you an orgasm.
cat
If only the USB people had allowed for 3-phase power in the original spec...
I'm not a lawyer, but I play one on the Internet. Blog
* Open a McDonalds Franchise $250,000
* Have Christina Aguilera on your TV show for 1 hour $225,000
* Create innovative defensive security technology and give it to Microsoft $200,000 Priceless!
When should I expect my cheque?
So every time you click on a non-malware site, then.... what?
your computer gives you an orgasm.
That's more likely to happen from a site containing malware, frankly.
So every time you click on a non-malware site, then.... what?
your computer gives you an orgasm.
Wait, don't porn sites generally have the most malware?
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
my Red Hat for your Blue Hat.
I mean correct me if I'm wrong but it sounds like rather then actually plugging the holes that cause problems, they are looking for another antivirus equivalent to try and stop things once they fall into the holes? It sounds like a bug bounty system that doesn't want to actually involve fixing bugs.
My solution would be equivalent to putting Microsoft in the Games folder and running any free operating system.
Like you guys said, one could net a lot more than $200k by solving the cancerous mal-ware that plagues MS systems for most users.
That's going to be the most help. Make out the check to fsf. You're welcome.
Help stamp out iliturcy.
Wow!
How CHEAP of them!
Only $200K for a technology that's going to make them hundreds of millions. I feel sorry for the sucker programmer who falls for this gag.
Like antivirus, and antimalware, they're trying to provide active defenses for when code tries to do something bad. ... but they continue to ignore the fact that the best defense is to not run bad code to begin with. They're so gung-ho on making it easy for the user to do what they want to do (which is an admirable enough goal) that we have:
Instead they're trying to install laser-turrets to shoot down every incoming mosquito after it's already intruded into our secure zone. Sure, that's nice too, but it's not a substitute.
it shocks the guy next to you
Disable all the external drives and ports and disable all the networking. I'll be collecting my check shortly.
The "winner" may get a check. The losers get their ideas tossed about at Microsoft with the possibility that a losing idea that has potential may be used in the future with nothing for "second place"
Hey Bob, no talk of subluxation this time? Getting subtler in your trolling, eh?
Guess what battery's are in a Taser...
So Microsoft's big idea is to buy software that other people have made?
I suppose it's not a bad business model, buy something that someone else created and rebrand it to sell it yourself...I mean hey, it worked for them before, right?
But why can't the world's largest software company do this themselves? I understand the need for an "outsider" to have a different perspective, but it seems that they should still be able to do this themselves.
Almost 30 years, and you still suck at life. Way to go, Microsoft.
Come up with a way to make security better and see if your material doesn't get stolen by M$?
M$ can be trusted to pay up, right?
Maybe you'll get a box of MS Word retail packages with a MSRP of $400 each instead of a check?
First to permanently turn Bob's computer off will probably win the prize.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
Don't thank Microsoft, thank Von Neumann Architecture for this problem. Can I just submit the Harvard architecture as a proposal and collect my 200k. Redesign how computers fundamentally use memory. (don't redesign, use what Harvard suggested 70 years ago) Can I have my money now?
This kind of contest worked pretty darn well for Netflix.
Be sure to make the check payable to Apple Inc. and not Apple Computer.
Say hello to my little sig.
The new security tech is reportedly called "Unix".
STOP HIDING FILE EXTENSIONS!
Really, this has got to be the premiere cause of users not gaining some semblance of understanding in the basics of Windows-based computing. Once users start seeing these little tags after the name of a file, everything becomes much easier to explain and suddenly users are undimmed, if not enlightened.
That is a tiny carrot and a frivolous smack in the face for some of the brightest minds on the planet. That is cheap sourcing tech if there ever was cheapsourcing. The five best ideas and their authors should form their own company and charge Microsoft $22B annually to keep that company's systems and software portfolios safe.
USB is positive 5 volts so your golden.
Unplug the network cable.
Tada! Instant security.
So rise up, all ye lost ones, as one, we'll claw the clouds.
Option 1: Disable network connection. Now you can only hack yourself. Option 2: Nuke the world; cockroaches can't hack. Nobody, no problem. Please send the money to the address in my profile. Thx.
Never say never. Ah!! I did it again!
In the face of mounting external pressure to begin paying bug bounties
get paid maybe $30,000 by microsoft for finding a bug
or create a piece of software that fixes a bug in windows and sell it at $5 a pop
(given the several hundred million user base)
guess which one microsoft would rather encourage
Valve is paying 1 million dollars for people playing a videogame.
Just asking.
Why is Snark Required?
They want to "defend against memory safety vulnerabilities?" I assume that they're talking about buffer overflows, if nothing else, and I can think of a couple of ways to prevent them: 1) non-von Neumann architecture; or, and here I'm going really crazy, I know, with an idea that'd disrupt the entire industry: 2) stop using bloody C.
Mind the Gap
Replace web browsers by virtual machines.
Rationale: web browsers are WAY too complicated to be ever secure; virtual machines, on the other hand need to support only a relatively small set of base instructions; as extra advantages, virtual machines are also more flexible and may relieve developers from the browser-compatibility headaches they've been having for years. Let's do it :)
If Pandora's box is destined to be opened, *I* want to be the one to open it.
I thought a Blue Hat was a Black Hat that couldn't get laid,
pocket calculator and a typewriter, and a fire-proof safe. These will cost you less than a reasonable PC and give you many years of service. Just send a couple of $1000 in real currency, none of the e-Money/net-money crap!
There was an unknown error in the submission.
Microsoft employed capability researcher Jonathan Shapiro for some time, but not any more. I wonder if that's because they decided it was too hard, unfeasible, never wanted caps at all, or some other reason. Caps would definitely be a way to defeat several if not most classes of bugs. In fact I have never encountered another method of computer security that seems credible.
Ok, this is crazy. A billion dollar company wants a researcher to give up IP that will make them millions for 200k. Don't do it!
http://no-spec.com/ [no-spec.com]
This is no different. M$'s "prize" is less than it would cost to PAY people to conduct the equivalent research. This kind of "contest" which is really "exploitation" should be considered an(other) unfair labour practice.
... if instead they could just implement the decades old experiences encountered in the *nix/linux field into their architecture, and they would get somewhere. This is just a marketing ploy to distract from the fact that they are just plain _stupid_
point...
there is nothing more to it really... they could start by splitting up services into different users for example, as we did, what? About 20 years ago? And rethink their own design mistakes done over the last 30 years... but hey; it's microsoft, so dream on, they don't want to, just want to keep the illusion they're working on improvement while sitting on their license income! Innovation to them, that's for nerd, and dreamers, not practical...
I, as a greedy and malicious individual, love when 90% of the worlds computers can be compromised simply because of bad management decisions. Keep up the good work. Keep making my life easier.
I'm paying $200,000 for your $1,000,000 working product... oh wait.
A return to the "old" to combat the problems of "the new" & why, in combination with filtering DNS servers (vs. malware-in-general in most ALL forms) that use DNSBL's vs. them! I have done so for YEARS now (since 2002 in my older Delphi model, which used "brute force" dedup methods which was FINE on HOSTS files in those days that only MAYBE hit 16k lines - lately, they're a LOT larger than that, so I switched to a Python system my nephew & I co-wrote that processes MILLIONS @ a time & faster dedup algorithms in place is why because of Python's built in routines).
It does the following things:
---
1.) Data gather from reputable sources for HOSTS data (some listed below, not all though), DNSBL's too!
2.) Alphabetize the data
3.) Removes duplicates/normalizes the data
4.) Changes from the larger & slower 127.0.0.1 "loopback adapter address" to the just as compatible & faster 0.0.0.0 "blackhole routing" address instead
5.) Filtering vs. "problematic" sites that MAY 'disturb' some sites IF their adbanner servers are disrupted (YAHOO, AOL, MSN & quite a few others)
6.) Commits back (from a "temp/scratch" file) to the ORIGINAL HOSTS file for use by the system &/or apps (@ RPL 0/Ring 0/kernelmode level, FAR faster & more efficient than Ring 3/RPL 3/Usermode filtering solutions are mind you) by OVERWRITE, assuring CLEAN COPY & a pristine unaltered (by malware) HOSTS file!
---
My HOSTS file currently protects me vs.
Why? Ok, read on:
20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
2.) Adblock blocks ads in only 1-2 browser family, but not all (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 5-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) Hosts files don't eat up CPU cycles like AdBlock does while it parses a webpages' content, nor as much as a DNS server does while it runs. HOSTS file are merely a FILTER for the kernel mode/PnP TCP/IP subsystem, which runs FAR FASTER & MORE EFFICIENTLY than any ring 3/rpl3/usermode app can.
7.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).
8.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:
GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LIS
"they wanted to encourage researchers to think about ways to defeat entire classes of bugs."
Easy, M$. Open the source code files and let the rest of the world do your job for you.
Yes, it's called Open Source.
Silly Paperclip.
You could reverse the polarity of the electrical connection :-p
Don't kid yourself. It's the size of the regexp AND how you use it that counts.