Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

121–130 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#121

Post by noir_lord »

pedrocr wrote: post #91
halfastack wrote: post #84

Earlier quoted context omitted.

Sure, but there's a difference between "yea, we like 7-zip, let's put some money into it" and "yea, we use Tomcat to actually run our apps connected to the DB, might be nice if it got a bit of patching" (and funnily enough, some of the user-centric apps have more funding than some of the backend, mission-critical SW).

My evaluation of the benefit is completely opposite to yours. An exploitable bug in 7-zip has a much higher impact than a bug in Tomcat. Tomcat is running somewhere in the backend so an exploitable bug is not usually usable as a direct attack. A bug in 7-zip can suddenly create a bunch of ransomware attacks just by distributing malicious files. We have a mountain of C code running in the wild parsing binary formats t…

> We have a mountain of C code running in the wild parsing binary formats that's in real need of some fuzzing or ideally replacement by safer languages.

In an ideal world that's what would happen but even if there where the will and the money it would take decades to replace all of this stuff in practice.

Sometimes when I'm feeling pessimistic I don't think we can ever truly secure (to a reasonable standard) anything.

Re: EU to fund bug bounty programs for open-source projects

#122

Post by calibas »

tbarbugli wrote: post #106
kyriakos wrote: post #34

Earlier quoted context omitted.

Why would they get out of PHP?

Do I really have to explain this?

PHP has matured greatly since version 5, especially in terms of performance, and Drupal 8 is a top choice for creating enterprise-level APIs. Neither is dead and Drupal is only "terrible" for beginners.

By most measurements, PHP is used by a majority of sites on the internet. The worst part is how many of those still use PHP 5, which reaches end of life tomorrow...

Re: EU to fund bug bounty programs for open-source projects

#123

Post by rfrey »

qha wrote: post #64
Jonnax wrote: post #61

Earlier quoted context omitted.

KDE is not worse than MATE. A full featured desktop environment with software suite compared to a fork of GTK 2.

MATE is a fork of GNOME 2, which is a full featured desktop environment as well. MATE runs orders of magnitude faster and is much more stable than KDE. Especially on the old workstations where they installed LiMux. I'm not going to say that the project failed entirely because of technical reasons, but at first glance it really looks like they took bad decisions. It's hard to defend a move where you end up with worse…

Orders of magnitude faster? 100 times faster? Gonna need to see some numbers before I believe that.

Re: EU to fund bug bounty programs for open-source projects

#124

Post by noir_lord »

omnimus wrote: post #40
azdacha wrote: post #25

Earlier quoted context omitted.

I very well know how much PHP is used. However the possibilities and outcomes a learning developper has by choosing PHP are very well enclosed to the few things PHP gives instead of the myriads of things other tools offer. I won't even talk about the semantic. On the other hand letting the dev learn JS or Python or even C++ in a pre-thought way will let much more different technologies and "tech-area" to their grasp…

It is called the long tail. PHP is only language with okay CMSs. The reason for it is the hosting model. It is easy way how to give someone package of files and they can buy their own managed hosting, put the files there and they have website. Its all the tiny businesses restaurants, schools, fan sites. Sites with 5 visitors a day. Probably like 50% of web is this. You can hate PHP all you want but there is no tech t…

I've programmed PHP professionally for the last 10 years (among others), modern PHP written by professionals is markedly better than it used to be and the PHP devs should get credit for that.

Re: EU to fund bug bounty programs for open-source projects

#125

Post by IshKebab »

gronne wrote: post #89
IshKebab wrote: post #57

Earlier quoted context omitted.

It's it? I try to use open source software as much as possible but Office365 is just significantly better than the alternatives. I wish it wasn't true but it is. And it's not even that expensive. £8/month/person. Slack is £5/month/person and that's just for chat. Considering an average employee probably costs at least £3000/month it's a bit silly to worry about these small expenses.

I disagree wrt office 365 (except for the collaborative editing in the browser feature). I dont recognize the price either - more like 22£ (unless its exchange only). Cost accumulates at scale.

Office 365 includes the "real" offline office apps. Prices here: https://products.office.com/en-gb/compare-all-microsoft-offi...

Re: EU to fund bug bounty programs for open-source projects

#126

Post by greglindahl »

tchaffee wrote: post #41
eikenberry wrote: post #6

Earlier quoted context omitted.

I think the community would keep this to a minimum just through normal peer pressure and shaming.

In order for that to happen, someone has to get caught. I think this opportunity for abuse deserves some more careful thought about how to prevent it.

People have thought about how to prevent it -- it's not a new issue.

Re: EU to fund bug bounty programs for open-source projects

#127

Post by pedrocr »

noir_lord wrote: post #121
pedrocr wrote: post #91

Earlier quoted context omitted.

My evaluation of the benefit is completely opposite to yours. An exploitable bug in 7-zip has a much higher impact than a bug in Tomcat. Tomcat is running somewhere in the backend so an exploitable bug is not usually usable as a direct attack. A bug in 7-zip can suddenly create a bunch of ransomware attacks just by distributing malicious files. We have a mountain of C code running in the wild parsing binary formats t…

> We have a mountain of C code running in the wild parsing binary formats that's in real need of some fuzzing or ideally replacement by safer languages. In an ideal world that's what would happen but even if there where the will and the money it would take decades to replace all of this stuff in practice. Sometimes when I'm feeling pessimistic I don't think we can ever truly secure (to a reasonable standard) anything…

>In an ideal world that's what would happen but even if there where the will and the money it would take decades to replace all of this stuff in practice.

In a previous discussion here someone pointed out you could actually compile C with hardening for out of bounds accesses for example. So maybe we need to isolate those input paths in programs and harden them.

>Sometimes when I'm feeling pessimistic I don't think we can ever truly secure (to a reasonable standard) anything.

I don't think we can either. In part it's just economics, the cost/value of the exploits is just too high for low-value targets. But it's yet another of the reasons I don't see how cryptocurrency ecosystems can really work. The security of the end-points is just way too low for me to trust that kind of thing.

Re: EU to fund bug bounty programs for open-source projects

#128

Post by NightlyDev »

the_duke wrote: post #14
azdacha wrote: post #8

Why PHP & Symphony ? This joke which is getting way too far. I'm getting tired of seeing it, and I'm tired of arguing why sticking with a language like that is a mistake. Bug Bounties are great, but I'd like to see people put their brain on for a moment and stop relying on what they learnt when they were 14 neither propose it as a valid solution today or encourage other people to use them. I'm getting very tired of t…

PHP is used for a massive amount of software out there. I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact. From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in. Regardless of how much you don't like PHP.

PHP is awesome. The whole "let's start from scratch on every request"-deal makes debugging really simple.

PHP isn't "complete", it could still need better support for multithreading and async operations, but that is also a part of what makes PHP so nice to work with.

It's fantastic for the live request-response situations.

Re: EU to fund bug bounty programs for open-source projects

#129

Post by Jonnax »

gronne wrote: post #90
coldtea wrote: post #83

Earlier quoted context omitted.

First, being abandoned for new development is a great indication of the quality of a project. Second, you haven't given us any arguments for your "indications of quality" regarding MATE and KDE. Third, like Gnome, KDE has a huge legacy in FOSS, and is a great project in itself based on a top notch GUI backend. Some of its code even went on and become the basis of the modern web (KHTML -> Webkit -> Blink -> Node -> no…

And I who thought the KDE/Gnome wars was over.

MATE is not a GNOME project. When GTK3 was made and the decision to build Gnome Shell was made, the MATE project was started to fork GTK2 and the old shell.

Re: EU to fund bug bounty programs for open-source projects

#130

Post by tchaffee »

greglindahl wrote: post #126
tchaffee wrote: post #41

Earlier quoted context omitted.

In order for that to happen, someone has to get caught. I think this opportunity for abuse deserves some more careful thought about how to prevent it.

People have thought about how to prevent it -- it's not a new issue.

In that case could you provide a source or two for those of us who want to get up to date with the current thinking?
Post reply on HN