Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

91–100 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#91

Post by pedrocr »

halfastack wrote: post #84
coldtea wrote: post #79

Earlier quoted context omitted.

> This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. The EU (Brussels offices, etc) actually using them?

Sure, but there's a difference between "yea, we like 7-zip, let's put some money into it" and "yea, we use Tomcat to actually run our apps connected to the DB, might be nice if it got a bit of patching" (and funnily enough, some of the user-centric apps have more funding than some of the backend, mission-critical SW).

My evaluation of the benefit is completely opposite to yours. An exploitable bug in 7-zip has a much higher impact than a bug in Tomcat. Tomcat is running somewhere in the backend so an exploitable bug is not usually usable as a direct attack. A bug in 7-zip can suddenly create a bunch of ransomware attacks just by distributing malicious files.

We have a mountain of C code running in the wild parsing binary formats that's in real need of some fuzzing or ideally replacement by safer languages.

Re: EU to fund bug bounty programs for open-source projects

#92

Post by gronne »

coldtea wrote: post #81
gronne wrote: post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

Or just employees got fed up with the "almost but not quite there" compatibility, and unpolished functionality, and wanted to return to MS Office. I've got a CS degree, have used Linux since 1998, used and developed for several commercial unices, and have used Open Office since it was Sun's. I still prefer MS Office.

Since LibreOffice 4.5ish I have preferred both writer and calc. Feels more robust and consistent + a lot snappier (incl. starttime).

I only use it for collaborative editing of docx and xlsx.

Re: EU to fund bug bounty programs for open-source projects

#95

Post by trulyrandom »

talltimtom wrote: post #94

So now the game for developers is to include intentional but sufficiently abscure bugs that they can harvest money off down the line.

I don't think developers would be eligible for bounties for vulnerabilities found in their own projects.

Re: EU to fund bug bounty programs for open-source projects

#96

Post by jdietrich »

kyriakos wrote: post #39
halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.

Most police forces use VLC to view CCTV recordings and other multimedia evidence. It's an entirely logical choice of software, but it presents an obvious risk in the current climate. I would imagine that many intelligence services use VLC for similar purposes.

A nation-state adversary with a VLC RCE 0day could do some serious damage; if they also have an 0day for a popular model of CCTV DVR, they've got the keys to the kingdom. Those DVRs will never get patched and a nation-state adversary could dream up all sorts of ways to induce a police officer or an intelligence agent to play a media file, but at least we can harden VLC.

Re: EU to fund bug bounty programs for open-source projects

#98

Post by cannedslime »

Even as a life long EU skeptic, I'm okay with this. Im not sure about the choice of projects, but I'm sure someone had their reasons for picking the projects that I don't find particularly relevant for a public funded bug bounty.

Eg. Im sure that Notepad++ has its share of bugs, but I doubt many are critical or security related.

Re: EU to fund bug bounty programs for open-source projects

#100

Post by jdietrich »

halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

It seems like a rather logical distribution of projects if you consider the ratio of (installed base/developer interest). The projects on this list all have massive user bases, but few of them would garner much excitement on HN and they have relatively small developer communities.

Filezilla, Notepad++ and 7-zip aren't in themselves mission-critical, but they're hugely popular products. If you can pwn an office computer or a developer workstation, you've made a crucial step towards pwning something properly sensitive. Think about the IT guy in a typical medium-sized business or a government department - what are the first things he's going to install on his own work computer? After Microsoft Office and his browser, what programs will he most often use to open untrusted files from the internet? What happens to the department if a trojan on his machine starts feeding his passwords to the FSB or the PLA?

Post reply on HN