Great idea, I hope they also put money to help get orgs out of PHP, Drupal and other dead/terrible software. If not this is a bit depressing and short sighted.
EU to fund bug bounty programs for open-source projects
31–40 of 153 posts
Re: EU to fund bug bounty programs for open-source projects
#32Great idea, I hope they also put money to help get orgs out of PHP, Drupal and other dead/terrible software. If not this is a bit depressing and short sighted.
What would be good alternatives for php and drupal?
Re: EU to fund bug bounty programs for open-source projects
#33Earlier quoted context omitted.
Is it worth spending money on Drupal considering we nowadays have anything else ? The answer is yes. The value of these bug bounty programs is directly tied to the amount of use the software gets (and most of these get used a ton, including Putty, regardless of alternatives).
Do people using these oldish softwares update them, though? Funding bug bounty programs kind of fail its objectives if they don't.
You're not wrong, but those are still separate issues. In the context of benefit for the government itself, you'd certainly hope so…
Regardless of whether they get updated, these are still a net benefit for new installs.
Re: EU to fund bug bounty programs for open-source projects
#34Great idea, I hope they also put money to help get orgs out of PHP, Drupal and other dead/terrible software. If not this is a bit depressing and short sighted.
Why would they get out of PHP?
Re: EU to fund bug bounty programs for open-source projects
#35Notepad++ seems to be only Windows. Seems would be better to support a cross-platform text editor.
Of that list, Notepad++ is the only product I use, so I'm happy with their decision :D
Re: EU to fund bug bounty programs for open-source projects
#36Notepad++ seems to be only Windows. Seems would be better to support a cross-platform text editor.
It also seems to be the third most popular dev environment overall (behind VS and VS Code, ahead of Sublime Text and Vim): https://insights.stackoverflow.com/survey/2018/#development-... It's not a very interesting target (most of these are not), but it's safe to say it's a valid target.
[deleted]
Re: EU to fund bug bounty programs for open-source projects
#37This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries.
I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE protocols and procedures. The idea probably is to curb the zero-day vulnerability leaks, but I assume that if you're able to find a CVE, you're capable of finding a CVE procedure.
Overall, though, this is great of course.
Re: EU to fund bug bounty programs for open-source projects
#38Earlier quoted context omitted.
I don’t see your issue with PHP. It’s a fairly good language to work with still. The fact that it’s often used by morons doesn’t make the language terrible (though most morons are now migrating to node.js).
I have no idea how the development of the PHP language works, but most languages are supported by their community, no? The amount of morons contributing the language tends to scale linearly with the amount of morons using it. Also, I'm sure most of this has been fixed, but it sure sounds like a terrible language... https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/
The community contributing in the PHP runtime and the community developing projects in PHP are two separate things. While the language itself has been evolving there are still a lot of bad quality PHP based projects and this has to do more with the low barrier of entry rather than PHP being a bad language on its own or the people contributing in it being bad developers. The last few years there's been a lot of good effort put in the language itself and it shows with the latest releases.
Re: EU to fund bug bounty programs for open-source projects
#39This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…
Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.
Re: EU to fund bug bounty programs for open-source projects
#40Earlier quoted context omitted.
PHP is used for a massive amount of software out there. I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact. From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in. Regardless of how much you don't like PHP.
I very well know how much PHP is used. However the possibilities and outcomes a learning developper has by choosing PHP are very well enclosed to the few things PHP gives instead of the myriads of things other tools offer. I won't even talk about the semantic. On the other hand letting the dev learn JS or Python or even C++ in a pre-thought way will let much more different technologies and "tech-area" to their grasp…
It is called the long tail. PHP is only language with okay CMSs. The reason for it is the hosting model. It is easy way how to give someone package of files and they can buy their own managed hosting, put the files there and they have website.
Its all the tiny businesses restaurants, schools, fan sites. Sites with 5 visitors a day. Probably like 50% of web is this.
You can hate PHP all you want but there is no tech that does this better (maybe serverless one day). And PHP cmses are in completely different league compared to anything else unfortunately. Things like Craft, Kirby, Bolt or even Wordpress nothing unfortunately compares.
Of course people here are gonna hate on it and i hate PHP as much as anyone but when you are living from making websites for 500eur and you need to make 3 a month then it is hard to beat.