Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

11–20 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#11

Post by jabl »

azdacha wrote: post #8

Why PHP & Symphony ? This joke which is getting way too far. I'm getting tired of seeing it, and I'm tired of arguing why sticking with a language like that is a mistake. Bug Bounties are great, but I'd like to see people put their brain on for a moment and stop relying on what they learnt when they were 14 neither propose it as a valid solution today or encourage other people to use them. I'm getting very tired of t…

The list reads like the EU commission surveyed what they had running on dusty forgotten servers in some closet.

The idea per se is good, though. We need to ensure that foundational infrastructure is properly maintained.

Re: EU to fund bug bounty programs for open-source projects

#12

Post by scrollaway »

jabl wrote: post #9

Is it worth to spend 90kEUR on putty, considering windows nowadays has openssh?

Is it worth spending money on Drupal considering we nowadays have anything else?

The answer is yes. The value of these bug bounty programs is directly tied to the amount of use the software gets (and most of these get used a ton, including Putty, regardless of alternatives).

Re: EU to fund bug bounty programs for open-source projects

#13

Post by em3rgent0rdr »

sddfd wrote: post #10
29athrowaway wrote: post #4

What if they took all the office suite licenses budget and they invested it in an open source office suite project like LibreOffice, Caligra suite (formerly KOffice) or Gnome Office.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

Munich did that, but they didn't do the second part of parent's suggestion: "and they invested it in an open source office suite..."

Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs.

Re: EU to fund bug bounty programs for open-source projects

#14

Post by the_duke »

azdacha wrote: post #8

Why PHP & Symphony ? This joke which is getting way too far. I'm getting tired of seeing it, and I'm tired of arguing why sticking with a language like that is a mistake. Bug Bounties are great, but I'd like to see people put their brain on for a moment and stop relying on what they learnt when they were 14 neither propose it as a valid solution today or encourage other people to use them. I'm getting very tired of t…

PHP is used for a massive amount of software out there.

I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact.

From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in.

Regardless of how much you don't like PHP.

Re: EU to fund bug bounty programs for open-source projects

#15

Post by lbeltrame »

em3rgent0rdr wrote: post #13
sddfd wrote: post #10

Earlier quoted context omitted.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

Munich did that, but they didn't do the second part of parent's suggestion: "and they invested it in an open source office suite..." Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs.

> Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs.

Actually LiMux did that. From an external PoV, I saw quite a number of commits coming from LiMux sponsored people in a few FOSS projects I follow.

Re: EU to fund bug bounty programs for open-source projects

#17

Post by r3bl »

em3rgent0rdr wrote: post #16

Notepad++ seems to be only Windows. Seems would be better to support a cross-platform text editor.

It also seems to be the third most popular dev environment overall (behind VS and VS Code, ahead of Sublime Text and Vim): https://insights.stackoverflow.com/survey/2018/#development-...

It's not a very interesting target (most of these are not), but it's safe to say it's a valid target.

Re: EU to fund bug bounty programs for open-source projects

#18

Post by emn13 »

eikenberry wrote: post #6
uh_what wrote: post #3

Seems like it would quite easy to game the system. Make contributions with known vulnerabilities and then submit an anonymous bug report when the contribution is approved.

I think the community would keep this to a minimum just through normal peer pressure and shaming.

And most open source projects run a fairly transparent dev process - almost by necessity. Doing something like that as an individual dev might be possible, but hard and likely impossible to do structurally (no guarantee to get it in, no guarantee for the project to be picked next year(s), no guarantee for nobody else to find it first, and upon discovery, risk that your scam becomes apparent).

But as a team, the only way to really pull this off involves inserting such vulnerabilities intentionally and out of sight, which means a closed dev process. Even if you orchestrate via some other medium - assuming you're using a VCS, the vulnerability will be publicly traceable to a core contributor - and if you do that regularly, you'll at the become known as a project that's a security nightmare; that might kill the project in the long run. And you might even raise suspicions purely base on the frequency and nature of vulnerabilities.

All in all: abusing this sounds like a fairly risky fraud.

Re: EU to fund bug bounty programs for open-source projects

#19

Post by dhh2106 »

rasengan wrote: post #2

This is a good step, and it’s great glibc is included. In the future, I think it would be great if more critical, widely distributed libraries/software could be included like that!

+1

It's a good initiative and needs a better selection / qualification process

Re: EU to fund bug bounty programs for open-source projects

#20

Post by Aeolun »

azdacha wrote: post #8

Why PHP & Symphony ? This joke which is getting way too far. I'm getting tired of seeing it, and I'm tired of arguing why sticking with a language like that is a mistake. Bug Bounties are great, but I'd like to see people put their brain on for a moment and stop relying on what they learnt when they were 14 neither propose it as a valid solution today or encourage other people to use them. I'm getting very tired of t…

I don’t see your issue with PHP. It’s a fairly good language to work with still.

The fact that it’s often used by morons doesn’t make the language terrible (though most morons are now migrating to node.js).

Post reply on HN