Slashdot Mirror
How Bug Bounties Are Like Rat Farming
Gunkerty Jeb writes "In a keynote speech at the United Security Summit, Stephen Dubner, co-author of Freakonomics, drew parallels between the increasingly popular (and successful) practice of software vendors offering bug bounties and a new industry springing up in Johannesburg, South Africa, where the population has recently found itself beset with a growing rat problem. In order to help mitigate their rodent problem, officials in Johannesburg began offering a small monetary rewards for each dead rat turned in. It was wildly successful, and it didn't take long for fresh batch of entrepreneurs to pop up and exploit the situation. Of course, I'm talking about rat farming. Evidently, business minded individuals have taken to breeding rats, only to kill them and turn them in for rewards. Obviously, rat farming is somewhat unscrupulous, but security researchers are doing the same thing: breeding bugs in the lab, then leading them to the slaughter for a nice payday. And it's a good thing."
Unless I missed something in the article, the analogy here makes absolutely no sense. Security researchers aren’t injecting the bugs into software and then “discovering” them. I can’t “breed” a bug into firefox only to turn it in for a profit. Unless they are claiming inside devs are introducing bugs for outside researchers to find and then splitting the profit, which isn’t how I read it (and probably wouldn’t work for too long anyway).
But it turns out that he knows more about security than one would think. Maybe even more than he might think.
Or perhaps not? This comes across as exactly the kind of outsider without a clue looking in type perspective that is described at the start of the article. Sometimes outside perspectives are useful, but this whole article is mostly pointless (besides the interesting story about rat farming).
The only potential point I can see (which they didn’t try to make, so I’m probably imagining it) is that by having these bounty programs, bugs are discovered that otherwise might not have been looked for. Very thin.
There is ZERO evidence that the people writing the software cited in the article are intentionally introducing bugs. This guy should either produce a smidgen of evidence or FOADIAF.
It doesn't say anything more than the Slashdot topic.
"I'm gonna write me a new minivan this afternoon!"
http://search.dilbert.com/comic/10%20Dollars%20Bug%20Fix
So we have 2 paragraphs of self advertisement, two on rat farming and then they mention bugs and the article ends. Okay, people are 'farming' bugs for cash. How, why and who cares?
you can breed rats, and they are rats. If you would get paid for a grey rat only once and not for every one, then you need to turn in brown, striped, checkered, white, blue, greeN, yellow rats. that would make the farming task way more complicated. Especially as there are other rat farmers out there doing the same.
And once all colors of rats have been done, it's over. no more rats...
Atari rules... ermm... ruled.
how exactly the researchers create bug in their lab? they maybe find them but only the developpers can create a bug no?
And that includes slashdot car and pizza analogies.
Unless he is claiming researchers are contributing code to said products that they know contains security bugs and then when it is released reporting it and claiming a bug bounty (and hiding the fact they contributed it since the rules say you can't do that of course).
But he isn't. So the anology is complete and utter garbage.
Okay, so who came up with this idea first? South Africa? Or Terry Pratchett?
End of lesson. You may press the button.
I heard about the rat farming story as a kid - and that is many years ago. The idea of relocating the story from 19th century US to South Africa strikes me as odd. But who knows, maybe the SA story has been verified.
The analogy isn't completely bogus. Think of it a slightly different way, a rat != a bug, a wild rat == a bug that would affect a user.
The farmed rats are then equivalent to the "could only really happen in a controlled lab environment" bug. They are still bugs, its good to get rid of them, but they aren't really (or at least shouldn't be) the primary concern.
Unless people are putting bugs in open source software, then claiming the bounties for finding them, the analogy is just plain wrong.
...and I don't even have to explain why, because every commend before me did it already.
Contrary to the popular belief, there indeed is no God.
I think he's trying to claim that a bug that's discovered by a security researcher before it can be (A) reported by a user or (B) exploited in a 0-day is an artificially created bug, not a "real" bug.
Which is, of course, idiotic; that's the whole point of paying researchers to find bugs.
http://thedailywtf.com/Articles/The-Defect-Black-Market.aspx
2. It just says it is similar to the bug hunting business - with NO explanation. No real discussion of the bug hunting business, no explanation why they are similar. It just assumes you will believe they are similar, with no reason. I don't see any connection.
3. It concludes with "and that's a good thing" with no explanation of why it is a good thing. Bull.
If I saw this in a blog, I would call it a bad blog. As an article, it is at best half of an article. It needs to to be doubled, if not tripled in size, to make any sense.
It also is not in any way convincing. I came away thinking the author may have an idea, but appears to be too clueless to express it to us.
excitingthingstodo.blogspot.com
http://www.klocwork.com/blog/2009/10/im-gonna-write-me-a-new-minivan-is-zero-software-bugs-the-right-goal/
If it is not a good analogy then isn't it ironic?
Facts take all of the premium out of arm waving - T. Reynolds
WTF? This make sabsolutely no sense. Bugs cannot be manufactured into existing software, they are created by the vendor not by the vulnerability finder. The analogy to rat frming is completely bogus
Ditto
This post contains no rudeness or derision of any kind. All arguments are friendly. Terms and exclusions may apply.
http://www.urbandictionary.com/define.php?term=FOADIAF
I think the point he's getting at is that a lot of the bugs are not the ones that would trouble users (i.e. they only appear "in the lab"). So although it's still good to fix them, they are low priority.
The farming analogy is bad because it implies people are creating these bugs just to turn them in, which as everyone is pointing out, doesn't make sense and would reflect poorly on the buggy developer, so it would be self-limiting. Instead, I propose he should have said "imported" rats instead of "farmed" rats: instead of killing the rats in the city (the "high priority" ones), people are going out into the country and killing rats that weren't really bothering anyone. Eventually they or their descendants might make it to the city and cause a problem, so we're certainly not sad to see them go (environmental concerns breaking the analogy here :)), but the point is those rats/bugs aren't really the ones we care about.
I could have sworn there was an article/blog post a little while back with statistics from a bug bounty program where most of the bugs were relatively trivial (found by automated methods, style consistency, etc.) or else quite obscure, with only a couple 'interesting' ones. But all I can find is this slashdot article, which I don't think is the one I'm thinking of. But I remember the author's summary was also that he still appreciated the peace-of-mind that others had looked through his code and that was all they had come up with, so still a net positive.
How exactly do researches 'plant' bugs into code released by another party?
Researcher: "Look look! We found a bug!"
Company: "Why yes you did! Wait... this isn't even our code! GTFO and stop wasting our time."
It would be better to say that because the government is paying for dead rats that an industry has developed around it. Now rather than just taking in urban rats that are causing a nuisance rat catchers are breaking into peoples homes to steal pet rats and taking trips in to the country with dogs to flush or rats in the wild.
... oh, that's right, it isn't.
So they've got another thing wrong. Big suprise.
(And not knowing the Ankh-Morpork precedent - that'll lose them fanboy cred).
... when a company happens to track who is the person responsible for a bug.
If there's no accountability, then a coder could generate bugs for a confederate on the outside to cash in on. Mind you, you'd need to make sure:
But, hey - who said scamsmanship was easy?
Strike while the irony is hot! -- The Freethinker
One of the commenters from TFA finally explained it, the problem is it's still a very bad analogy. Farmed rats !=manufactured bugs. The actual analogy is wild rats == significant bugs and farmed rats == insignificant bugs. He's not saying the "bug farmers" are manufacturing the bugs, just that they're finding new and creative ways to break the software that would in all likelihood never occur outside of a lab setting.
So, like I said, a very bad analogy.
Boy, do we need some information on what Dubner actually said. Here's the only thing I've found from the conference organizers:
http://www.unitedsummit.org/speakers.jsp?speaker=stephen-dubner
There is a live stream of whatever talk is going on now, but I can't find any information about the content yesterday's talks.
The researchers aren't introducing the bugs into the software, of course; they're simply finding flaws that might not have been found under other circumstances.
So it's actually nothing like rat farming.
If you read the article (I didn't at first either), it's says that researcher are finding bugs in a lab that would never have been found otherwise (not by hackers either), but concludes that this is a good thing. It's a happy story about how bug bounties are good for everybody, and leads to better software... :) :)
- It's not a dumb article, it's just a happy one
We're just confused because articles are always expected to be negative, this one isn't, now smile
The (current) last two paragraphs of the article were added after many of the /. comments were posted.
Previous final sentences:
But are those bugs being bred in the lab by researchers just to be led to the slaughter for a nice payday? Yes, yes they are. And that's a good thing.
Added paragraphs:
The researchers aren't introducing the bugs into the software, of course; they're simply finding flaws that might not have been found under other circumstances. Those who run the bug bounty programs at the software companies say that they are seeing more and more submissions than they did before their programs began, and the combined resources of the external researchers and the vendors' internal teams finds far more flaws than just the internal teams could.
The idea of people raising rats for the express purpose of killing them likely isn't what the officials had in mind when they began their reward program, and they may well end up with a larger rat infestation than they had when they began if they put a stop to the rewards and the rats end up wandering the streets. But the opposite has occurred with the vendors' bug bounty programs. As they've continued to reward researchers and even raise the amount they pay for new bugs, researchers have responded with more submissions, and all of the users of those applications have benefited.
Seems like an attempt to rescue the article from terminal idiocy. But it's just digging a deeper hole.
It's just like rat farming! Except that nobody's manufacturing defects deliberately.
Rat farming had unintended consequences! Bug bounties have exactly the consequences that their designers were aiming for: lots of people detecting bugs.
Okay, so in South Africa, bounties for dead rats had the unintended consequence of creating rat farmers which is 180 degrees counter to what the creators of the bounty wanted. It's a classic case of perverse incentives. On the other hand, the software bug bounties are resulting in more software bugs being found and fixed. Exactly what the creators of the software bug bounties wanted. And, no one, not even the bad-analogy-maker, is suggesting that the security researchers are introducing software bugs only to 'fix' them later. So these two situations are really pretty much exact opposites... This is probably the worst analogy I've ever encountered.
I had always kind of figured the Freakonomics guys were more pop-pseudo-science than actual hard science. But I'm not an expert in any of the other fields they've discussed. Now I guess I know for sure that they're full of it.
We always knew Comcast was corrupt, here's the proof: http://tech.slashdot.org/comments.pl?sid=1909890&cid=34545432
I used Google rat farming site:wikipedia.org to find a citation in the Wikipedia article about perverse incentives. I didn't read the original source because it appears to be paywalled and in French, and I am not affiliated with any of these subscribing institutions.
I actually thought once that having an unlimited open season on trapping rats in DC would be a good idea. That's not a joke--DC has a serious rate problem. I concluded that imported and/or bred rats would be an insurmountable problem. It's nice to know that I can still think ahead of the guys who run countries in Africa.
BTW, the best way we have so far to control rats is to STOP FEEDING THEM. If you enforce laws against unsecure garbage, then you don't have to enforce laws against breeding rats to get the bounty. In DC the city itself violates basic sanitation by having most sidewalk receptacles with open tops, and by not emptying them fast enough.
They poison rats, but when rats have leftover prime rib from the garbage they don't eat uniformly sized pellets of poison. Rats are smart, and street rats are smarter than lab rats. What happens is that the bait stations end up being used as shelters by the rats. That particular wrinkle of the problem led me to a "modest proposal":
Instead of trying to poison the rats and feed the homeless, DC should try it the other way around. In short order, poisoning centers for the homeless would be built but would not be stocked with sufficient poison or attended. They would provide excellent shelter.
http://dilbert.com/strips/comic/1995-11-13/
Nothing new to this.
Twenty years ago, I worked at a company (whose name you have all heard but I'd best not mention) which, among other things, produced development tools. A major release was coming up, and the word went out: company-wide cash bounty on bugs. The more severe, the bigger the bounty.
BUT... neither Development nor QA on the product team in question were entitled to participate.
An underground economy of bugs immediately arose. QA people would find bugs and tell their tech support buddies. Developers would drop in a bug and notify the documentation people. Folks in the localization team for installers for the company's consumer productivity apps suddenly became experts on memory management defects... somehow. The rewards would be split. Over 50,000 dollars in bounties were handed out before the company got wind of this and put a quick, angry end to it.
If there is a way to game the system, people will figure it out in a heartbeat. Call it... meta-testing.
disclaimer: I only heard about this after the fact. I was not at the company when the incident occurred; I was hired about two months afterward, and the stories were still circulating. Perhaps that's why the position I filled had become open...
Everybody gets what the majority deserves.
If bug bounties are like rat farming, then vendors will start creating more software vulnerabilities so they can pay out security researchers more money? Security has enough crappy analogies without non-security people throwing in their two cents.
Hopefully Kaspersky Lab (the owners of threatpost.com) will be able to extract some sort of apology, or at least a clarification that edits done after the post should be clearly marked as such.
If you don't want to use the feedback form, you can email nicole.lawler, greg.sabey, or alejandro.arango, all at kaspersky dot com.
Dennis Fisher, the article's author, is getting royally roasted for such an obvious sham of a correlation. There is much backpedaling happening now, with a stealth article edit (at least one) having already occurred and replies to comments indicating Fisher will become his own worst enemy. They would be smart to remove the article, complete with its flubbed analogy, until he can bring sufficient reasoning to the table. As it sits, it's only going to degenerate further.
What is being manufactured is the market itself. rat FARMING was created by the bounty, not rats. Get the correct terms in the analogy and it makes a whole lot of sense.
"The researchers aren't introducing the bugs into the software, of course; they're simply finding flaws that might not have been found under other circumstances. Those who run the bug bounty programs at the software companies say that they are seeing more and more submissions than they did before their programs began, and the combined resources of the external researchers and the vendors' internal teams finds far more flaws than just the internal teams could."
Another blog post, another site: http://www.leadershipblog.co.za/2010/08/11/stephen-dubner/
It quotes Dubner directly. Dubner says nothing about bug bounties in relation to rat farming.
He talks about the rat farming anecdote, then talks about unintended consequences in general, in the realm of government, not software development.
His main observation seems to be that politicians have no incentive to create schemes that are immune to unintended consequences, because the unintended consequences are usually long-term -- and the politicians only want their scheme to reflect well on them long enough to get re-elected, earn bonuses, etc. in the short term.
The nonsensical leap to bug bounties is an invention of Dennis Fisher's.