Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

51–60 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#51

Post by raverbashing »

halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

There's a distinction between your examples: the first ones are user tools, the latter are backend applications or libraries

My guess is that the main objective is to address user-visible bugs. While a glibc bug is certainly impactful, it is usually solvable before it gets too widespread.

(And as I much as it's "not the right way", higher level apps work around it before it is fixed)

Re: EU to fund bug bounty programs for open-source projects

#52

Post by CJefferson »

progval wrote: post #45
kyriakos wrote: post #39

Earlier quoted context omitted.

Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.

> which have records of bugs have causing them problems even glibc? > I can't see how VLC can be as mission critical as Kafka. VLC can run on public screens

A friend of mine spent last Christmas debugging an issue in memcpy in glibc (on Intel 32-bit CPUs). Glibc is less well tested than I expected, and has ASM implementations of many functions for many CPUs, some of which are (obviously) less well supported than others.

Re: EU to fund bug bounty programs for open-source projects

#53

Post by qha »

gronne wrote: post #27
sddfd wrote: post #10

Earlier quoted context omitted.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

That's true, there was cronyism. For example, they used the worse, slower KDE instead of better options like MATE because KDE has a considerable European (and even German) legacy. I imagine they took many decisions like that.

Take a computer that used to run Windows 2000 and install KDE on it, it's no wonder people got pissed and they had to revert their decision.

Re: EU to fund bug bounty programs for open-source projects

#55

Post by MrBuddyCasino »

sddfd wrote: post #10
29athrowaway wrote: post #4

What if they took all the office suite licenses budget and they invested it in an open source office suite project like LibreOffice, Caligra suite (formerly KOffice) or Gnome Office.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

> political considerations ultimately reversed the decision

Thats a very one-sided portrayal of the situation. There were problems regarding usability, the resulting low user acceptance and issues with external MS Office files due to compatibility bugs.

If anything, funding the project for so long was a symptom of putting ideological and political considerations before user needs.

I find it very weird how even most software developers prefer MBPs with MS Office on them, but some poor souls elsewhere are supposed to do their daily work on a sub-standard platform. I mean we're still joking about the "Year of the Linux Desktop".

Re: EU to fund bug bounty programs for open-source projects

#56

Post by conanthe »

vertex-four wrote: post #46
interfixus wrote: post #44

My disillusion and cynicism know few bounds in any matter involving the EU (or any political body, for that matter). Over the years, something like this could easily morph into 'this open source software certified and legal to use within the EU' .

The EU has been funding the development of open source software through grants for many years now.

The EU funds nothing, it is the tax-payer.

Re: EU to fund bug bounty programs for open-source projects

#57

Post by IshKebab »

gronne wrote: post #27
sddfd wrote: post #10

Earlier quoted context omitted.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

It's it? I try to use open source software as much as possible but Office365 is just significantly better than the alternatives. I wish it wasn't true but it is.

And it's not even that expensive. £8/month/person. Slack is £5/month/person and that's just for chat.

Considering an average employee probably costs at least £3000/month it's a bit silly to worry about these small expenses.

Re: EU to fund bug bounty programs for open-source projects

#58

Post by a_bonobo »

halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can execute code with user privileges (like https://www.videolan.org/security/sa1801.html ), if you can automate that you have access to many personal computers in the EU

Re: EU to fund bug bounty programs for open-source projects

#59

Post by 29athrowaway »

MrBuddyCasino wrote: post #55
sddfd wrote: post #10

Earlier quoted context omitted.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

> political considerations ultimately reversed the decision Thats a very one-sided portrayal of the situation. There were problems regarding usability, the resulting low user acceptance and issues with external MS Office files due to compatibility bugs. If anything, funding the project for so long was a symptom of putting ideological and political considerations before user needs. I find it very weird how even most s…

The EU asked for the standardization of Microsoft Office file formats, and the "Office Open XML" format (OOXML for short) was created (ECMA-376).

The resulting standard was 6,546 pages long (in comparison, ODF is just 867 pages long), and Microsoft Office was not fully compliant with it, making the entire process a waste of time. 10 years later situation is the same.

It is reasonable to believe that interoperability and standardization were not in the best interest of Microsoft. They have the largest market share and they have not much to win by giving opportunities to competitors.

You can read more here: https://en.wikipedia.org/wiki/Standardization_of_Office_Open...

Re: EU to fund bug bounty programs for open-source projects

#60

Post by int0x80 »

CJefferson wrote: post #52
progval wrote: post #45

Earlier quoted context omitted.

> which have records of bugs have causing them problems even glibc? > I can't see how VLC can be as mission critical as Kafka. VLC can run on public screens

A friend of mine spent last Christmas debugging an issue in memcpy in glibc (on Intel 32-bit CPUs). Glibc is less well tested than I expected, and has ASM implementations of many functions for many CPUs, some of which are (obviously) less well supported than others.

IA32 is probably not getting all the focus from devs and users this days, still surprising whoever... Do you have a link to the issue, out of curiosity?
Post reply on HN