Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

111–120 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#111

Post by cyphar »

amenod wrote: post #103
a_bonobo wrote: post #58

Earlier quoted context omitted.

Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can execute code with user privileges (like https://www.videolan.org/security/sa1801.html ), if you can automate that you have access to many personal computers in the EU

Also, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...

There's work going on (since 2016) to port the parsers to Rust[1]. I believe that a few already are written in Rust, and it'd be great if some Rust folks would help out with the effort.

[1]: https://youtu.be/YTy_JOxGOd4

Re: EU to fund bug bounty programs for open-source projects

#112

Post by denzil_correa »

halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

> I wonder what went into the decision process to include each of these libraries.

The decision making process was a survey [0]. The two criteria used were (1) usage of software inside and outside the EU and (2) critical nature of the software for institutions and users.

[0] https://joinup.ec.europa.eu/news/results-eu-fossa-survey

Re: EU to fund bug bounty programs for open-source projects

#113

Post by dullgiulio »

johnisgood wrote: post #87
Jonnax wrote: post #66

Earlier quoted context omitted.

Tax payers fund all governing bodies. What's the criticism?

I think one could ask such questions: "have you tried not funding what you don't even know about?" or "have you tried not paying your taxes?"

Like not funding scientific research and going to prison for tax evasion. Both have been tried, believe me.

Re: EU to fund bug bounty programs for open-source projects

#114

Post by kyriakos »

tbarbugli wrote: post #106
kyriakos wrote: post #34

Earlier quoted context omitted.

Why would they get out of PHP?

Do I really have to explain this?

Yes, if you have an application running on a currently supported platform why would you want to move away from it?

Re: EU to fund bug bounty programs for open-source projects

#116

Post by maltalex »

gronne wrote: post #92
coldtea wrote: post #81

Earlier quoted context omitted.

Or just employees got fed up with the "almost but not quite there" compatibility, and unpolished functionality, and wanted to return to MS Office. I've got a CS degree, have used Linux since 1998, used and developed for several commercial unices, and have used Open Office since it was Sun's. I still prefer MS Office.

Since LibreOffice 4.5ish I have preferred both writer and calc. Feels more robust and consistent + a lot snappier (incl. starttime). I only use it for collaborative editing of docx and xlsx.

Were you using it for documents in English?

Because I don't know about German specifically, but with some languages, Libre office is very buggy.

Re: EU to fund bug bounty programs for open-source projects

#117

Post by kilotaras »

justaj wrote: post #107
amenod wrote: post #103

Earlier quoted context omitted.

Also, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...

Is mpv [0] better in this regard? 0: https://mpv.io/

GP isn't saying that VLC is unsafe, but rather that C (which VLC is written in) tends to be unsafe. Seeing as MPV is also written in C, it's absolutely the same in that regard.

Re: EU to fund bug bounty programs for open-source projects

#118

Post by mantas »

halfastack wrote: post #104
pedrocr wrote: post #91

Earlier quoted context omitted.

My evaluation of the benefit is completely opposite to yours. An exploitable bug in 7-zip has a much higher impact than a bug in Tomcat. Tomcat is running somewhere in the backend so an exploitable bug is not usually usable as a direct attack. A bug in 7-zip can suddenly create a bunch of ransomware attacks just by distributing malicious files. We have a mountain of C code running in the wild parsing binary formats t…

The thing is, "somewhere in the backend" is generally accessible from the internet, and vulnerable to attackers (so you need only a maliciously crafted packet, or something similar); whereas for 7-zip vulnerability, there must be: a) a maliciously crafted zip file, b) a user who wilfully opens it. What's more, getting into one's backend servers/gaining some kind of access to DB, config files of the machine, etc. is,…

Gov agencies do accept zip files from general population. Send them something, they'll have to open it to respond to your request... Bam, you broke into a PC with sensitive system inside of a gov network.

Re: EU to fund bug bounty programs for open-source projects

#119

Post by Tarq0n »

halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

There was a bit of a scare around a 7-zip vulnerability earlier this year. [0] Turns out 7-zip is embedded inside a lot of other programs making those vulnerable too.

[0] https://www.cisecurity.org/advisory/a-vulnerability-in-7-zip...

Re: EU to fund bug bounty programs for open-source projects

#120

Post by noir_lord »

jdietrich wrote: post #96
kyriakos wrote: post #39

Earlier quoted context omitted.

Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.

Most police forces use VLC to view CCTV recordings and other multimedia evidence. It's an entirely logical choice of software, but it presents an obvious risk in the current climate. I would imagine that many intelligence services use VLC for similar purposes. A nation-state adversary with a VLC RCE 0day could do some serious damage; if they also have an 0day for a popular model of CCTV DVR, they've got the keys to t…

That is an interesting thought.

I'd never considered that an excellent media playback program would be a vector for nation state and entities with nation state capabilities.

Post reply on HN