Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

141–150 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#141
post #60

Earlier quoted context omitted.

IA32 is probably not getting all the focus from devs and users this days, still surprising whoever... Do you have a link to the issue, out of curiosity?

https://github.com/fingolfin/memmove-bug

Wow thats scary indeed... They where using x86 signed compare instead of unsigned (jg vs ja)... Thanks for the link btw!

Re: EU to fund bug bounty programs for open-source projects

#142
post #70

Never heard about "Digital Signature Services (DSS), FLUX TL, midPoint, WSO2". Why were they chosen?

DSS is EU-owned library I believe. I used it instead reimplementing digital signature verification for XMLs, PDFs, hadling certificate revocation, etc. Makes sense that they want to secure own library that secures many other applications. WSO2 is Enterprise Service Bus that I used at another company (owned by government BTW) instead of one from whoever-makes-commercial-ESBs.

WSO2 is more than just Enterprise Service Bus. There are a bunch of products and solutions belongs to WSO2[1]. Enterprise Service Bus, API Gateway, Identity and Acess Manager, Analytics and Stream Processing Server are the core products.

[1] https://wso2.com/platform

Re: EU to fund bug bounty programs for open-source projects

#143
post #10

Earlier quoted context omitted.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

Munich did that, but they didn't do the second part of parent's suggestion: "and they invested it in an open source office suite..." Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs.

For so.e of the problems that is the case. Some of fheproblems were that no other municipality joined them in the effort, which leaves them a sole fighter in a world where they have to use software provided by other authorities. One example is ordering a passport was initially setup by running the software provided by the federal administration via terminal server, however the. Finger prints were added to passports so the setup didn't work anymore and even being "the largest municipality in Germany" (cities of Berlin and Hamburg are larger, but they delegated more municipality tasks to the districts and are also states) doesn't give them much leverage.

They way the decision came into play is crazy however. Just around the elections Microsoft moved their German headquarters from outside the city into the city and the next elected deputy mayor from the conservative party was disappointed that it took much time to get an official mobile phone from the IT department and setting up mail on that device was complicated ... not idea how that's related to desktops, but that triggered the debate ...

Re: EU to fund bug bounty programs for open-source projects

#144
post #28
post #20

Earlier quoted context omitted.

I don’t see your issue with PHP. It’s a fairly good language to work with still. The fact that it’s often used by morons doesn’t make the language terrible (though most morons are now migrating to node.js).

I have no idea how the development of the PHP language works, but most languages are supported by their community, no? The amount of morons contributing the language tends to scale linearly with the amount of morons using it. Also, I'm sure most of this has been fixed, but it sure sounds like a terrible language... https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

Most of all the stuff in the fractal of bad design is still there, which is mostly caused by PHP 7.2 still being more or less compatible with PHP 4, which is basically the strength of PHP.

There’s better solutions to almost all of those issues now though.

Re: EU to fund bug bounty programs for open-source projects

#145
post #102

Earlier quoted context omitted.

> the optional malware you get during FileZilla's installation. Think that through. The malware that comes with FileZilla is often reported to be pretty bad. Agreed, potential a 0 day (especially when targeted) could also have a really bad effect. But Filezilla's malware isn't theoretical, so could really be the bigger problem.

I haven't used Filezilla in a _long_ time -- is the malware optional? I imagine that most EU governments image their machines, so they IT departments likely aren't installing the malware. And there is also the consideration that governments will continue to use Filezilla even if there isn't EU funding to make it more secure -- malware and all.

Good points. Yeah, I'd hope it's the IT departments doing images, rather than end users being able to install things.

Re: EU to fund bug bounty programs for open-source projects

#146

Earlier quoted context omitted.

It's it? I try to use open source software as much as possible but Office365 is just significantly better than the alternatives. I wish it wasn't true but it is. And it's not even that expensive. £8/month/person. Slack is £5/month/person and that's just for chat. Considering an average employee probably costs at least £3000/month it's a bit silly to worry about these small expenses.

Slack has many competitors. You can replace it. Does MS Office have real competitors? Google Docs is very casual compared to MS Office. LibreOffice needs a lot of work. My money was on Corel Office for Linux (with solid products like Wordperfect and Quattro Pro), but Microsoft bought a large share of Corel and it was mysteriously discontinued.

Slack has competitors but none of them are as good. At least none of the free ones - I've tried them all. Zulip is closest but it has a weird threading model (it's more like Usenet).

It's quite surprising given how relatively simple it is.

Re: EU to fund bug bounty programs for open-source projects

#147

So now the game for developers is to include intentional but sufficiently abscure bugs that they can harvest money off down the line.

I don't think developers would be eligible for bounties for vulnerabilities found in their own projects.

Probably not.

However, such a limitation is rather easy to workaround. Which means now, buggy commits are going to look suspicous.

Re: EU to fund bug bounty programs for open-source projects

#148
post #92

Earlier quoted context omitted.

Since LibreOffice 4.5ish I have preferred both writer and calc. Feels more robust and consistent + a lot snappier (incl. starttime). I only use it for collaborative editing of docx and xlsx.

Were you using it for documents in English? Because I don't know about German specifically, but with some languages, Libre office is very buggy.

Star division was german, I'm quite sure it works well with german.

( star office -> open office -> libre office )

Re: EU to fund bug bounty programs for open-source projects

#149
post #107
post #103

Earlier quoted context omitted.

Also, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...

Is mpv [0] better in this regard? 0: https://mpv.io/

AFAIK both VLC and mpv use FFmpeg's codecs, so their attack surfaces should be similar.

Re: EU to fund bug bounty programs for open-source projects

#150
post #53
post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

That's true, there was cronyism. For example, they used the worse, slower KDE instead of better options like MATE because KDE has a considerable European (and even German) legacy. I imagine they took many decisions like that. Take a computer that used to run Windows 2000 and install KDE on it, it's no wonder people got pissed and they had to revert their decision.

The LiMux project started in 2005, so the KDE version used back then would be KDE3. That was not really worse in performance than GNOME2 (or today MATE), although comparing it to Windows 2000 would not be easy.
Post reply on HN