41–50 of 153 posts
Seems like it would quite easy to game the system. Make contributions with known vulnerabilities and then submit an anonymous bug report when the contribution is approved.
I think the community would keep this to a minimum just through normal peer pressure and shaming.
Earlier quoted context omitted.
I think the community would keep this to a minimum just through normal peer pressure and shaming.
And most open source projects run a fairly transparent dev process - almost by necessity. Doing something like that as an individual dev might be possible, but hard and likely impossible to do structurally (no guarantee to get it in, no guarantee for the project to be picked next year(s), no guarantee for nobody else to find it first, and upon discovery, risk that your scam becomes apparent). But as a team, the only…
This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…
Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.
even glibc?
> I can't see how VLC can be as mission critical as Kafka.
VLC can run on public screens
My disillusion and cynicism know few bounds in any matter involving the EU (or any political body, for that matter). Over the years, something like this could easily morph into 'this open source software certified and legal to use within the EU' .
My disillusion and cynicism know few bounds in any matter involving the EU (or any political body, for that matter). Over the years, something like this could easily morph into 'this open source software certified and legal to use within the EU' .
The EU has been funding the development of open source software through grants for many years now.
Seems like it would quite easy to game the system. Make contributions with known vulnerabilities and then submit an anonymous bug report when the contribution is approved.
What's the difference? It's a systemic flaw.
If there exists an incentive for finding vulnerabilities, there exists an incentive for introducing vulnerabilities. Bug bounties work great for closed source companies because there doesn't exist a misalignment of incentives. If Johnny keeps writing buggy code, he gets fired. If anonymous234 gets his buggy pull request approved, confederate anonymous456 gets to make a few bucks.
Follow up #2: For the skeptical downvoters, I'll put my money where my mouth is and attempt to capture the bounties using the method described above.
Earlier quoted context omitted.
Do people using these oldish softwares update them, though? Funding bug bounty programs kind of fail its objectives if they don't.
You're not wrong, but those are still separate issues. In the context of benefit for the government itself, you'd certainly hope so… Regardless of whether they get updated, these are still a net benefit for new installs.
Earlier quoted context omitted.
PHP is used for a massive amount of software out there. I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact. From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in. Regardless of how much you don't like PHP.
I very well know how much PHP is used. However the possibilities and outcomes a learning developper has by choosing PHP are very well enclosed to the few things PHP gives instead of the myriads of things other tools offer. I won't even talk about the semantic. On the other hand letting the dev learn JS or Python or even C++ in a pre-thought way will let much more different technologies and "tech-area" to their grasp…
For bigger companies which host their own sites, other languages may be better choices.