Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU to fund bug bounty programs for open-source projects

zdnet.com

Post reply on HN
Print view View original

81–90 of 153 posts

Re: EU to fund bug bounty programs for open-source projects

#81

Post by coldtea »

gronne wrote: post #27
sddfd wrote: post #10

Earlier quoted context omitted.

The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

Or just employees got fed up with the "almost but not quite there" compatibility, and unpolished functionality, and wanted to return to MS Office.

I've got a CS degree, have used Linux since 1998, used and developed for several commercial unices, and have used Open Office since it was Sun's. I still prefer MS Office.

Re: EU to fund bug bounty programs for open-source projects

#82

Post by cyphar »

justinclift wrote: post #62

This all sounds good, with the exception of FileZilla, who (still) distribute malware ("bundled ad offers") with their default Windows downloads. :( Seems kind of bizarre the EU would encourage such practises.

I think it's a stretch to say that the EU is "encouraging" such scummy practices. It's likely that they just collated a list of all software used widely by government departments within the EU -- and thus FileZilla is on the list. Ultimately, a potential 0day causing RCE within a government department is more of a concern to the EU than the optional malware you get during FileZilla's installation.

Re: EU to fund bug bounty programs for open-source projects

#83

Post by coldtea »

qha wrote: post #80
Jonnax wrote: post #72

Earlier quoted context omitted.

There's barely any development on the GitHub. And also it seems like there are few contributers. Whilst KDE is a much bigger project that is actively developed.

If that's your indicative of the quality of a project then I understand your position.

First, being abandoned for new development is a great indication of the quality of a project.

Second, you haven't given us any arguments for your "indications of quality" regarding MATE and KDE.

Third, like Gnome, KDE has a huge legacy in FOSS, and is a great project in itself based on a top notch GUI backend. Some of its code even went on and become the basis of the modern web (KHTML -> Webkit -> Blink -> Node -> now also Edge), other tools like KDevelop, Krita, etc are among the best in class in what they do.

What are you, some teenage Linux nerd, with a "favorite" desktop to promote in flame wars?

Re: EU to fund bug bounty programs for open-source projects

#84

Post by halfastack »

coldtea wrote: post #79
halfastack wrote: post #37

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE proto…

> This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. The EU (Brussels offices, etc) actually using them?

Sure, but there's a difference between "yea, we like 7-zip, let's put some money into it" and "yea, we use Tomcat to actually run our apps connected to the DB, might be nice if it got a bit of patching" (and funnily enough, some of the user-centric apps have more funding than some of the backend, mission-critical SW).

Re: EU to fund bug bounty programs for open-source projects

#85

Post by vertex-four »

interfixus wrote: post #75
Jonnax wrote: post #67

Earlier quoted context omitted.

What you said hasn't happened.

Silly me. What hasn't happened, never will happen. Sorry. No governing body will ever threaten software freedom.

No, but you’ve got to have an argument for why this particular round of funding is somehow different from the others which haven’t led to what you suggest so far - what is it?

Or is there some general argument for why the EU funding open source software will lead to our demise? Does this round mark a specific point in the journey to free software being made illegal?

“Governments funding open source software is bad because reasons” isn’t really a useful post on Hacker News.

Re: EU to fund bug bounty programs for open-source projects

#86

Post by coldtea »

azdacha wrote: post #25
the_duke wrote: post #14

Earlier quoted context omitted.

PHP is used for a massive amount of software out there. I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact. From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in. Regardless of how much you don't like PHP.

I very well know how much PHP is used. However the possibilities and outcomes a learning developper has by choosing PHP are very well enclosed to the few things PHP gives instead of the myriads of things other tools offer. I won't even talk about the semantic. On the other hand letting the dev learn JS or Python or even C++ in a pre-thought way will let much more different technologies and "tech-area" to their grasp…

What's all this emotionalization of the situation?

In the end PHP is a tool. And despite the constant whining, it has created a great many projects people want to use and use (by choice).

When you create an as good alternative for people's actual needs (and not what you consider people's needs to be, like "elegant code") we can see if we can get them to switch to that.

Professionals use tools. Whiners and amateurs complain about ideals.

>I cannot think of PHP companies as something else than a no-innovation, no-research, no-interest & no change since 2000's.

Is this supposed to be satire?

>Now please tell me what I can do with PHP, I want to see newcomers read what options you have by learning PHP.

You get access to a turn-key, widely supported, language and ecosystem, that powers close to 80% of the web. Including extremely popular CMS options. Plus, access to some of the cheapest hosting you can find. You can also write all kinds of backend and cli stuff in it if you want.

And you can always use ANOTHER TOOL for a different job, if PHP is not suitable. What a concept huh? Who would have thought.

Re: EU to fund bug bounty programs for open-source projects

#87

Post by johnisgood »

Jonnax wrote: post #66
interfixus wrote: post #63

Earlier quoted context omitted.

Careful! Any EU criticism, scepticism, or disdain, however soft and tentatively phrased, will unleash an army of downvoters in these hallowed halls.

Tax payers fund all governing bodies. What's the criticism?

I think one could ask such questions: "have you tried not funding what you don't even know about?" or "have you tried not paying your taxes?"

Re: EU to fund bug bounty programs for open-source projects

#88

Post by merb »

coldtea wrote: post #81
gronne wrote: post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

Or just employees got fed up with the "almost but not quite there" compatibility, and unpolished functionality, and wanted to return to MS Office. I've got a CS degree, have used Linux since 1998, used and developed for several commercial unices, and have used Open Office since it was Sun's. I still prefer MS Office.

not in this case. people coming from office 2003 have a hard time with 2010 or higher. it had a lot of things to do with smartphones which are problematic in the windows environment aswell. also germany builds more and more web interfaces for administrative work.

Re: EU to fund bug bounty programs for open-source projects

#89

Post by gronne »

IshKebab wrote: post #57
gronne wrote: post #27

Earlier quoted context omitted.

Thats a nice way of putting cronyism, lobbyism and tech-iliteratism.

It's it? I try to use open source software as much as possible but Office365 is just significantly better than the alternatives. I wish it wasn't true but it is. And it's not even that expensive. £8/month/person. Slack is £5/month/person and that's just for chat. Considering an average employee probably costs at least £3000/month it's a bit silly to worry about these small expenses.

I disagree wrt office 365 (except for the collaborative editing in the browser feature). I dont recognize the price either - more like 22£ (unless its exchange only).

Cost accumulates at scale.

Re: EU to fund bug bounty programs for open-source projects

#90

Post by gronne »

coldtea wrote: post #83
qha wrote: post #80

Earlier quoted context omitted.

If that's your indicative of the quality of a project then I understand your position.

First, being abandoned for new development is a great indication of the quality of a project. Second, you haven't given us any arguments for your "indications of quality" regarding MATE and KDE. Third, like Gnome, KDE has a huge legacy in FOSS, and is a great project in itself based on a top notch GUI backend. Some of its code even went on and become the basis of the modern web (KHTML -> Webkit -> Blink -> Node -> no…

And I who thought the KDE/Gnome wars was over.
Post reply on HN