Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

101–110 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#101

Post by justinclift »

cyphar wrote: post #82
justinclift wrote: post #62

This all sounds good, with the exception of FileZilla, who (still) distribute malware ("bundled ad offers") with their default Windows downloads. :( Seems kind of bizarre the EU would encourage such practises.

I think it's a stretch to say that the EU is "encouraging" such scummy practices. It's likely that they just collated a list of all software used widely by government departments within the EU -- and thus FileZilla is on the list. Ultimately, a potential 0day causing RCE within a government department is more of a concern to the EU than the optional malware you get during FileZilla's installation.

> the optional malware you get during FileZilla's installation.

Think that through. The malware that comes with FileZilla is often reported to be pretty bad.

Agreed, potential a 0 day (especially when targeted) could also have a really bad effect.

But Filezilla's malware isn't theoretical, so could really be the bigger problem.

Re: EU to fund bug bounty programs for open-source projects

#102

Post by cyphar »

justinclift wrote: post #101
cyphar wrote: post #82

Earlier quoted context omitted.

I think it's a stretch to say that the EU is "encouraging" such scummy practices. It's likely that they just collated a list of all software used widely by government departments within the EU -- and thus FileZilla is on the list. Ultimately, a potential 0day causing RCE within a government department is more of a concern to the EU than the optional malware you get during FileZilla's installation.

> the optional malware you get during FileZilla's installation. Think that through. The malware that comes with FileZilla is often reported to be pretty bad. Agreed, potential a 0 day (especially when targeted) could also have a really bad effect. But Filezilla's malware isn't theoretical, so could really be the bigger problem.

I haven't used Filezilla in a _long_ time -- is the malware optional? I imagine that most EU governments image their machines, so they IT departments likely aren't installing the malware.

And there is also the consideration that governments will continue to use Filezilla even if there isn't EU funding to make it more secure -- malware and all.

Re: EU to fund bug bounty programs for open-source projects

#103

Post by amenod »

a_bonobo wrote: post #58
halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can execute code with user privileges (like https://www.videolan.org/security/sa1801.html ), if you can automate that you have access to many personal computers in the EU

Also, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...

Re: EU to fund bug bounty programs for open-source projects

#104

Post by halfastack »

pedrocr wrote: post #91
halfastack wrote: post #84

Earlier quoted context omitted.

Sure, but there's a difference between "yea, we like 7-zip, let's put some money into it" and "yea, we use Tomcat to actually run our apps connected to the DB, might be nice if it got a bit of patching" (and funnily enough, some of the user-centric apps have more funding than some of the backend, mission-critical SW).

My evaluation of the benefit is completely opposite to yours. An exploitable bug in 7-zip has a much higher impact than a bug in Tomcat. Tomcat is running somewhere in the backend so an exploitable bug is not usually usable as a direct attack. A bug in 7-zip can suddenly create a bunch of ransomware attacks just by distributing malicious files. We have a mountain of C code running in the wild parsing binary formats t…

The thing is, "somewhere in the backend" is generally accessible from the internet, and vulnerable to attackers (so you need only a maliciously crafted packet, or something similar); whereas for 7-zip vulnerability, there must be: a) a maliciously crafted zip file, b) a user who wilfully opens it.

What's more, getting into one's backend servers/gaining some kind of access to DB, config files of the machine, etc. is, in my mind, just infinitely worse than gaining access to a computer of a person/uploading some ransomware/something similar.

We're just probably working with different SW, so we both see the thing that touches us the most as the problem... :))

Re: EU to fund bug bounty programs for open-source projects

#105

Post by Proven »

They fund open source projects and now they fund bug submissions and fixes too.

I'd be surprised if this bureaucrat-driven innovation doesn't result in the same people producing shitty OSS and then claiming bug bounties through their cousins in Bulgaria.

The EU is ruled by a mix of quasi-capitalist thieves, and socialist morons who fancy central planning.

What they're doing is not only against the spirit of OSS but an abomination of "free" (the licenses may be "free" but it's all funded through state theft and involuntary taxes!)

Re: EU to fund bug bounty programs for open-source projects

#106

Post by tbarbugli »

kyriakos wrote: post #34
tbarbugli wrote: post #31

Great idea, I hope they also put money to help get orgs out of PHP, Drupal and other dead/terrible software. If not this is a bit depressing and short sighted.

Why would they get out of PHP?

Do I really have to explain this?

Re: EU to fund bug bounty programs for open-source projects

#107

Post by justaj »

amenod wrote: post #103
a_bonobo wrote: post #58

Earlier quoted context omitted.

Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can execute code with user privileges (like https://www.videolan.org/security/sa1801.html ), if you can automate that you have access to many personal computers in the EU

Also, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...

Is mpv [0] better in this regard?

0: https://mpv.io/

Re: EU to fund bug bounty programs for open-source projects

#108

Post by distances »

qha wrote: post #53
gronne wrote: post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

That's true, there was cronyism. For example, they used the worse, slower KDE instead of better options like MATE because KDE has a considerable European (and even German) legacy. I imagine they took many decisions like that. Take a computer that used to run Windows 2000 and install KDE on it, it's no wonder people got pissed and they had to revert their decision.

It's obvious you're being provocative on purpose but I don't see this leading to any fruitful discussion. Maybe try a more constructive approach next time.

Re: EU to fund bug bounty programs for open-source projects

#109

Post by pedrocr »

halfastack wrote: post #104
pedrocr wrote: post #91

Earlier quoted context omitted.

My evaluation of the benefit is completely opposite to yours. An exploitable bug in 7-zip has a much higher impact than a bug in Tomcat. Tomcat is running somewhere in the backend so an exploitable bug is not usually usable as a direct attack. A bug in 7-zip can suddenly create a bunch of ransomware attacks just by distributing malicious files. We have a mountain of C code running in the wild parsing binary formats t…

The thing is, "somewhere in the backend" is generally accessible from the internet, and vulnerable to attackers (so you need only a maliciously crafted packet, or something similar); whereas for 7-zip vulnerability, there must be: a) a maliciously crafted zip file, b) a user who wilfully opens it. What's more, getting into one's backend servers/gaining some kind of access to DB, config files of the machine, etc. is,…

> The thing is, "somewhere in the backend" is generally accessible from the internet

If this is the case you have much bigger problems that a bug bounty won't fix.

> in my mind, just infinitely worse than gaining access to a computer of a person/uploading some ransomware/something similar

That depends heavily on what the backend server is. There are plenty of databases where a hack is irrelevant because the data is public and there are backups. Meanwhile most people have poor backups and a hack can be incredibly damaging.

>we both see the thing that touches us the most as the problem

I think you're heavily discounting the risk that all these code bases in general usage pose. I've fuzzed C++ binary parsing code on just a laptop and was amazed at how many crashing bugs I was able to find in a short amount of time. Many of those were probably easily exploitable.

Re: EU to fund bug bounty programs for open-source projects

#110

Post by Ayesh »

halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

For me, the biggest advantage of big country programs is the ease of reporting something. Not every software has a direct security report procedure documented.

For those who wish to get credit for them, those bug country sites help too.

Post reply on HN