Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

131–140 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#131

Post by greglindahl »

tchaffee wrote: post #130
greglindahl wrote: post #126

Earlier quoted context omitted.

People have thought about how to prevent it -- it's not a new issue.

In that case could you provide a source or two for those of us who want to get up to date with the current thinking?

Here's one example, you can find many more with a little googling: https://stackoverflow.com/a/39708317/1370917

If you look at the question, you can see that some people don't make the connection that the motivation behind code signing is figuring out who committed suspicious code. Code that has security bugs is one interest, another is code which the committer didn't have permission to commit, for example proprietary code.

Re: EU to fund bug bounty programs for open-source projects

#132

Post by gnomewascool »

Jonnax wrote: post #61
qha wrote: post #53

Earlier quoted context omitted.

That's true, there was cronyism. For example, they used the worse, slower KDE instead of better options like MATE because KDE has a considerable European (and even German) legacy. I imagine they took many decisions like that. Take a computer that used to run Windows 2000 and install KDE on it, it's no wonder people got pissed and they had to revert their decision.

KDE is not worse than MATE. A full featured desktop environment with software suite compared to a fork of GTK 2.

> a fork of GTK 2

For strict accuracy, MATE is not a fork of GTK2, but of GNOME 2. MATE did originally use GTK2, though without forking it, and it has since switched to GTK3 (while still keeping the GNOME 2 "look").

Re: EU to fund bug bounty programs for open-source projects

#133

Post by jimnotgym »

qha wrote: post #53
gronne wrote: post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

That's true, there was cronyism. For example, they used the worse, slower KDE instead of better options like MATE because KDE has a considerable European (and even German) legacy. I imagine they took many decisions like that. Take a computer that used to run Windows 2000 and install KDE on it, it's no wonder people got pissed and they had to revert their decision.

> Take a computer that used to run Windows 2000

out of a museum, or a skip perhaps

>and install KDE on it

Then put Windows 10 on it, or any other fully featured modern GUI OS. And we have proved what? Computers from 18 years ago don't run modern OS's very well, but can run ok with an OS specifically pitched as 'lightweight'.

On the other hand I have a PC right here on my lap that is 10 years old that is running Kubuntu problem free.

Re: EU to fund bug bounty programs for open-source projects

#134

Post by jimnotgym »

_pmf_ wrote: post #115

Targeting existing projects has the advantage of creating fewer perverse incentives. EU funds for open ended projects are notorious for being leeched.

> EU funds for open ended projects are notorious for being leeched

Can you give some examples please?

Re: EU to fund bug bounty programs for open-source projects

#135

Post by tchaffee »

greglindahl wrote: post #131
tchaffee wrote: post #130

Earlier quoted context omitted.

In that case could you provide a source or two for those of us who want to get up to date with the current thinking?

Here's one example, you can find many more with a little googling: https://stackoverflow.com/a/39708317/1370917 If you look at the question, you can see that some people don't make the connection that the motivation behind code signing is figuring out who committed suspicious code. Code that has security bugs is one interest, another is code which the committer didn't have permission to commit, for example proprietar…

Thanks for the link. So I submit some code that is signed and it's a good contribution that closes an issue. I intentionally include a subtle bug. My friend who lives in a different country uses the bug bounty program to fix the bug and he collects the money. How do you detect that scenario with code signing?

Re: EU to fund bug bounty programs for open-source projects

#136

Post by johnisgood »

dullgiulio wrote: post #113
johnisgood wrote: post #87

Earlier quoted context omitted.

I think one could ask such questions: "have you tried not funding what you don't even know about?" or "have you tried not paying your taxes?"

Like not funding scientific research and going to prison for tax evasion. Both have been tried, believe me.

Haha, if only. :)

Re: EU to fund bug bounty programs for open-source projects

#137

Post by CJefferson »

int0x80 wrote: post #60
CJefferson wrote: post #52

Earlier quoted context omitted.

A friend of mine spent last Christmas debugging an issue in memcpy in glibc (on Intel 32-bit CPUs). Glibc is less well tested than I expected, and has ASM implementations of many functions for many CPUs, some of which are (obviously) less well supported than others.

IA32 is probably not getting all the focus from devs and users this days, still surprising whoever... Do you have a link to the issue, out of curiosity?

https://github.com/fingolfin/memmove-bug

Re: EU to fund bug bounty programs for open-source projects

#138

Post by conanthe »

Jonnax wrote: post #65
conanthe wrote: post #54

EU or the tax-payer without being asked? They are getting really smug with their propaganda and have no accountability.

You seem to fundamentally misunderstand what the EU does. Each country funds the EU, it creates laws and also has programmes across the member countries. Each country elects Members of the European Parliament. No country in the EU is a direct democracy where the public vote on every decision. They elect a politician to make those decisions for them. Do you complain when your local government builds a road to someone…

MEPs don't create laws. They make part of the deception. The body that shapes the EU and decides nonsense like this is unelected.

Re: EU to fund bug bounty programs for open-source projects

#139

Post by 29athrowaway »

IshKebab wrote: post #57
gronne wrote: post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

It's it? I try to use open source software as much as possible but Office365 is just significantly better than the alternatives. I wish it wasn't true but it is. And it's not even that expensive. £8/month/person. Slack is £5/month/person and that's just for chat. Considering an average employee probably costs at least £3000/month it's a bit silly to worry about these small expenses.

Slack has many competitors. You can replace it.

Does MS Office have real competitors? Google Docs is very casual compared to MS Office. LibreOffice needs a lot of work.

My money was on Corel Office for Linux (with solid products like Wordperfect and Quattro Pro), but Microsoft bought a large share of Corel and it was mysteriously discontinued.

Re: EU to fund bug bounty programs for open-source projects

#140

Post by rendx »

The European Commission also has additional calls out for intermediaries to re-distribute funding to open source projects (ICT24), and some of the intermediaries have their respective calls open for projects (from 5k€ to 200k€):

https://www.ngi.eu/opencalls/ https://ec.europa.eu/info/funding-tenders/opportunities/port...

Post reply on HN