Slashdot Mirror
EU Offers Big Bug Bounties On 14 Open Source Software Projects (juliareda.eu)
Julia Reda is a member of Germany's Pirate Party, a member of the European Parliament, and the Vice-President of The Greens-European Free Alliance.
Thursday her official web site announced: In 2014, security vulnerabilities were found in important Free Software projects. One of the issues was found in the Open Source encryption library OpenSSL.... The issue made lots of people realise how important Free and Open Source Software is for the integrity and reliability of the Internet and other infrastructure.... That is why my colleague Max Andersson and I started the Free and Open Source Software Audit project: FOSSA... In 2017, the project was extended for three more years. This time, we decided to go one step further and added the carrying out of Bug Bounties on important Free Software projects to the list of measures we wanted to put in place to increase the security of Free and Open Source Software...
In January the European Commission is launching 14 out of a total of 15 bug bounties on Free Software projects that the EU institutions rely on.
The bounties start at 25.000,00 € -- about $29,000 USD -- rising as high as 90.000,00 € ($103,000). "The amount of the bounty depends on the severity of the issue uncovered and the relative importance of the software," Reda writes.
Click through for a list of the software projects for which bug bounties will be offered.
Thursday her official web site announced: In 2014, security vulnerabilities were found in important Free Software projects. One of the issues was found in the Open Source encryption library OpenSSL.... The issue made lots of people realise how important Free and Open Source Software is for the integrity and reliability of the Internet and other infrastructure.... That is why my colleague Max Andersson and I started the Free and Open Source Software Audit project: FOSSA... In 2017, the project was extended for three more years. This time, we decided to go one step further and added the carrying out of Bug Bounties on important Free Software projects to the list of measures we wanted to put in place to increase the security of Free and Open Source Software...
In January the European Commission is launching 14 out of a total of 15 bug bounties on Free Software projects that the EU institutions rely on.
The bounties start at 25.000,00 € -- about $29,000 USD -- rising as high as 90.000,00 € ($103,000). "The amount of the bounty depends on the severity of the issue uncovered and the relative importance of the software," Reda writes.
Click through for a list of the software projects for which bug bounties will be offered.
- Filezilla
- Apache Kafka
- Notepad++
- PuTTY
- VLC Media Player
- FLUX TL
- KeePass
- 7-zip
- Digital Signature Services (DSS)
- Drupal
- GNU C Library (glibc)
- PHP Symfony
- Apache Tomcat
- WSO2
This list should be expanded to include many other projects as well, such as OpenSSH, etc...
I applaud the EU for their efforts!!!
Release the hounds
Some of these look pretty arbitrary. Why Filezilla, a client for a dying technology? Why Notepad++, which is desktop software which is not networked nor used in mission-critical environments? Why Putty and not Openssh? Why Yet Another Crypto Library instead of a more widely used one?
This is open source software, you maroon. Whoever wants to pay for it, will.
The rest of us get the updates for free.
Filezilla uploads and downloads files from and to your web site.
Notepad++ is used for fundamental work, like programming and checking the validity of HTML and organizing HTML web pages. (See the Tidy2 plugin.)
See the list of Notepad++ plugins.
If those programs are found to have a serious deficiency, the deficiencies will be fixed and the bounty paid. Mostly nothing will be paid because deficiencies won't be found.
And who do you think will pay for what happens if any of the software on that list gets hacked and comprises some governmental or commercial data? Funding research that benefits us all (or most of us) is exactly the thing that tax money should be used for.
It's one of those few politicians who grok IT and software and know what matters, instead of swallowing all the nonsense lobbies throw at them.
I've heard a couple of talks by her and really wish we had a couple more like her.
Are they insane? They've invented a new transport layer for their very specific use case (exchange of fisheries data) instead of using something proven and now expect everyone to debug their code.
And calling this open source software is exaggeration. I could find only a single release on their website (v1.7.1) and there is no download link.
Hey let me wash your windshield! No really let me wash your windshield with this duty newspaper! Now give me two dollars I washed your windshield. See? It has only a few more filthy spots than before!
And who is going to pay for all the resulting updates?
European taxpayers will pay for it.
The reasoning is that paying for bug fixes will likely be cheaper than paying for security breaches.
I lean libertarian, yet even I see this as a good use of taxpayer euros. The bug fixes help everyone, and they are leveraging the profit motive of the private sector to make it happen.
Disclaimer: I am not a European taxpayer.
Yep I absolutely want someone straight out of university "fixing" OpenSSL.
https://en.wikipedia.org/wiki/...
Since you've pointed it out,
You shall pay for it
All of it!
From now,
Until Forever
Moehahahahahhaa
captcha : admiring
Paying to find bugs won't make much sense unless you also provide cash to fund the maintainers for additional manpower. Open source maintainers are already spending all their allotted time on maintaining the code. Simply identifying more bugs doesn't fix the manpower issue and makes their job even more difficult.
If you are identifying problems (bugs) you should also offer solutions (funding).
Tomcat is going to bankrupt the fund.
My advice, do a web search for "printing money" and find out what it means when economists use that term.
Because it doesn't mean, "they spent money in a way I didn't approve of." And it isn't even close to that.
Computers don't care who typed code it, it runs the same regardless of what letters are next to a person's name, or how long their letters have been carefully aged.
No need for scare-quotes around the word fixed, it is a bug bounty not some sort of contract to attempt to fix bugs. If they didn't fix it, they won't get paid.
Will let you use FTP. For good reason.
openssl had 10 severe vulnerabilities caused by those "senior" programmers.
You don't get my point anyway.
If you want certified or "safe" s/w, you're off to corporate s/w(a.k.a. closed source). OSS comes with this(example from GPL):
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM âoeAS ISâ WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
>implying
So, your argument is: if you want secure software, you have to buy 'corporate software', because open source software comes with a disclaimer?
I can only assume you have never read the fine print of corporate software.
Oh, I see. The problem is you don't know what a bug bounty is.
The payment is only for finding bugs, not fixing them.
EU taxpayers will not pay for it. Businesses will. Or more likely they will not (because nobody can afford to), and the newly revealed vulnerabilities will result in yet more zombie servers on the internet. Great. So what was the point of this?
Someone above mentioned funding for maintainers. That would be a hell of a lot more productive, and would be doing the business community a favor, instead of trying to pull the rug out from under it.
Tax payers supporting new EU tech jobs.
Domestic spying is now "Benign Information Gathering"
Someone above mentioned funding for maintainers. That would be a hell of a lot more productive
No, unconditional funding is a terrible idea. It would quickly turn into yet another entitlement.
Paying for finding/fixing actual bugs means money is only paid for performance.
Incentives need to be aligned with objectives. If you want bug fixes, you pay for bug fixes, not for "effort".
Or is that funded separately?
It seems strange that Drupal with 3.5% market share (globally across both public and private sector) of CMS'es is on the list and yet WordPress, which is the most dominant CMS by far, isn't on the list despite having 59.7% CMS market share (figures from W3Techs).
Maybe the European public sector uses Drupal more than WordPress (I have no specific figures on that), but I seriously doubt it considering the 17:1 worldwide usage disparity. Or is Drupal considered less secure than WordPress and needs more fixes? Again, I doubt that - WordPress is a much bigger target for hackers and has a lot more third-party plugins which vary very widely in quality of code.
May your bones rot in some nameless place in Hungary, next to Orbans corrupt corpse.
You stink.
Because the Web knows economy. Bummer.
Uh, cite a single piece of commercial software that provided a warranty for your data. I personally havenâ(TM)t seen a single one.
When instead you can pay $100,000,000s for a software security surveillance department within the military?
So you'd be happy with a developer with zero experience working on a complex crypto library. You must be an IT manager.
So you'd be happy with a woozle wurt and bleeble blazzer? What?
I didn't say anything like that, man. Just because you didn't understand the words, doesn't mean I was providing you a Mad Libs. Instead of replacing the words you didn't understand, just look them up.
PVS-Studio and Bug Bounties on Free and Open Source Software: https://medium.com/@karpov2007...
I must be getting old, no-one else thinks of this when they hear "bug bounty"?
https://dilbert.com/strip/1995...
Complexity is Easy. Simplicity is Hard.