Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The European Parliament has approved budget for VLC bug bounty program

hackerone.com

Post reply on HN
Print view View original

21–30 of 37 posts

Re: The European Parliament has approved budget for VLC bug bounty program

#21

Post by detaro »

ars wrote: post #16
detaro wrote: post #8

Earlier quoted context omitted.

Because it's software the EU institutions use. EDIT: VLC was the third-highest ranked one from a survey on what software to study, with the two already reviewed ones (KeePass and Apache HTTPD) being above it.

It's because VLC was written in Europe, in Paris specifically. It's more multinational now, but still primarily a European project. Realistically they are not going to fund an American project. I know the Internet makes "country" semi-obsolete (at least when describing software), countries themselves still care a lot about that.

They funded a review for Apache HTTPD before, and basically all other candidates are international projects: https://joinup.ec.europa.eu/news/ec-audit-apache-http-serve-...

I wouldn't be surprised though if EU-centric communities were more likely to know/care about this initiative (and thus voted), putting 2 european projects in the top 3.

Re: The European Parliament has approved budget for VLC bug bounty program

#24

Post by madez »

ars wrote: post #16
detaro wrote: post #8

Earlier quoted context omitted.

Because it's software the EU institutions use. EDIT: VLC was the third-highest ranked one from a survey on what software to study, with the two already reviewed ones (KeePass and Apache HTTPD) being above it.

It's because VLC was written in Europe, in Paris specifically. It's more multinational now, but still primarily a European project. Realistically they are not going to fund an American project. I know the Internet makes "country" semi-obsolete (at least when describing software), countries themselves still care a lot about that.

The internet does not make countries obsolete. Who thinks that is inside a bubble that can burst horribly painfully.

The internet is a way to share information very fast and very cheap, but that's it. There are still countless of other dimensions that are more important, and they are often organized by countries.

Economic welfare of all regions and decentralized power over/knowledge about infrastructure such as software is important. It is very much not irrelevant whether a project is developed in Europa, China, USA, India or Russia.

I expect authorities to take into account where the majority of the development is happening. They should do that.

EDIT: Replaced the wrong word 'fairwell' with 'welfare'.

Re: The European Parliament has approved budget for VLC bug bounty program

#25

Post by dvt »

a3_nm wrote: post #17
barrkel wrote: post #13

Earlier quoted context omitted.

It pays to be paranoid. I believe I'd be able to add exploitable bugs that would not be detected in most code reviews; there's a large library of techniques available from underhanded C competitions and similar.

If malicious people can add exploitable bugs and claim a bug bounty later, then they can also add exploitable bugs to actually exploit them. So I'd say that bug bounties also work here: they create an incentive to review the code of open-source projects more closely.

After a look at some of the bugs linked at http://www.underhanded-c.org/_page_id_2.html, they are very niche and difficult to exploit in any meaningful way. Not only that, but even a mediocre test suite would find something fishy with most.

Re: The European Parliament has approved budget for VLC bug bounty program

#26

Post by RobertoG »

barrkel wrote: post #13
dvt wrote: post #12

Earlier quoted context omitted.

This seems a bit paranoid. It's not like OSS doesn't have code review processes.

It pays to be paranoid. I believe I'd be able to add exploitable bugs that would not be detected in most code reviews; there's a large library of techniques available from underhanded C competitions and similar.

>"It pays to be paranoid."

Then, it's not paranoia.

Re: The European Parliament has approved budget for VLC bug bounty program

#28

Post by DKnoll »

madez wrote: post #24
ars wrote: post #16

Earlier quoted context omitted.

It's because VLC was written in Europe, in Paris specifically. It's more multinational now, but still primarily a European project. Realistically they are not going to fund an American project. I know the Internet makes "country" semi-obsolete (at least when describing software), countries themselves still care a lot about that.

The internet does not make countries obsolete. Who thinks that is inside a bubble that can burst horribly painfully. The internet is a way to share information very fast and very cheap, but that's it. There are still countless of other dimensions that are more important, and they are often organized by countries. Economic welfare of all regions and decentralized power over/knowledge about infrastructure such as softw…

Good points.

> Economic fairwell of all regions

You're looking for the word 'welfare' here, by the way.

Re: The European Parliament has approved budget for VLC bug bounty program

#29

Post by icebraining »

chasil wrote: post #27

It would be nice if they also approved one for Android Stagefright. All monthly Android security bulletins from this year have critical CVEs in the media system. https://source.android.com/security/bulletin/

I think Google can afford to pay for that.
Post reply on HN