36 ms·

I wonder what impact this will have on open source software (OSS). OSS can't afford to pay people to look for bugs and improve the overall software. But commer

I wonder what impact this will have on open source software (OSS). OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can. I wonder if there will exist a date/time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.

tptacek 9y ago
Facebook, Github, and Microsoft already co-sponsor a well-funded open-source "Internet bug bounty".
darawk 9y ago
It seems like this might be in part balanced by the fact that it's much easier to find vulnerabilities in open source software, since it's open source.
harigov 9y ago
If you think about it, it was always that way. However, a lot of companies that depend upon open source software also invest on it, so it also gets a reasonably good number of eyes trying to fix bugs and add features.
computerex 9y ago
I think that is already the case to some extent.
jklein11 9y ago
Similar behaviors likely exists in OSS they are just called different things. For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes. In the case of OSS, the pool of resources is likely far bigger than with closed source software.
- efdee 9y ago
  That's how the theory goes, but how often does this really happen though? See: OpenSSL
  - tptacek 9y ago
    The simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.
    - bitmapbrother 9y ago
      Google's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.
      - lawnchair_larry 9y ago
        Hehe, "favor"
  - skrebbel 9y ago
    On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
    - sand500 9y ago
      Is github itself open source tho?
      - jtl999 9y ago
        Well I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)
cgb223 9y ago
Maybe we should start some sort of foundation dedicated to providing the same incentive to find bugs in OSS I'd imagine there are a lot of programmers who would be interested in supporting something like this
- dsacco 9y ago
  You mean something like The Internet Bug Bounty?
43gg43g32g 9y ago
OSS already had bug bounties a long time ago.
markstos 9y ago
Many companies large and small already pay penetration testers to try into break into their Linux-based servers on a regular basis. I was personally involved in a case where a recognizable brand's pen testing effort lead to a fix a well-used piece of open source software. There is a lot of open source is already being fixed thanks to commercial interests.
kazinator 9y ago
To begin with, some OSS doesn't even know how to treat people who report bugs.
- gerdesj 9y ago
  Citation needed
  - deleted 9y ago
    [deleted]
- detaro 9y ago
  The average OSS project probably is better about that than the average software company though - at least with OSS projects you can be reasonably secure that they won't send lawyers or the police after you for finding bugs.
  - yorwba 9y ago
    It is also easier for an outsider to figure out where to report the bug. I had a bug using NLTK to display parse trees in Jupyter notebooks. NLTK uses tkinter to render the parse trees to PostScript and GhostScript to produce a png image. The chain broke when the PostScript output had a font size of 0. If this had been a bug in a closed-source program, all I could have put in a bug report would have been "doesn't work, pls fix". Instead, I could submit a workaround to NLTK and start looking for the reason tkinter generated malformed PostScript output. This turned out to be because Tcl/Tk's font handling used Xft, which used FontConfig, and used an integer for the font size where FontConfig expected a double. Everything worked fine until FontConfig started doing floating point math on the font size. The Tk maintainer who triaged my bug report couldn't even reproduce it on his system, because his version of FontConfig only ever copied the value. Only because every component of the chain was open source, was it possible to track the bug down and fix it.
gerdesj 9y ago
"OSS can't afford to pay people" You don't really understand how open source works, do you? cough shill cough. The source is free but you are also free to build consultancy etc on the back of it. "I wonder if there will exist ... yield better (less buggy) software vs OSS." - RLY?
runeks 9y ago
> OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can. Software insurance companies can invest a part of the insurance premium on OSS in bug bounties. It’s a shame more people aren’t aware of software insurance, since OSS has several advantages in this area, for example that the source code is available to everyone, such that insurance companies can pay everyone in the world to find bugs in the software they’re insuring. That’s a definite advantage. It’s not often that an insurance company has the opportunity to invite everyone in the world to help them assess the quality of what they’re insuring.
nsgi 9y ago
Mozilla has a bug bounty.

tptacek 9y ago

Facebook, Github, and Microsoft already co-sponsor a well-funded open-source "Internet bug bounty".

darawk 9y ago

It seems like this might be in part balanced by the fact that it's much easier to find vulnerabilities in open source software, since it's open source.

harigov 9y ago

If you think about it, it was always that way. However, a lot of companies that depend upon open source software also invest on it, so it also gets a reasonably good number of eyes trying to fix bugs and add features.

computerex 9y ago

I think that is already the case to some extent.

jklein11 9y ago

Similar behaviors likely exists in OSS they are just called different things. For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes. In the case of OSS, the pool of resources is likely far bigger than with closed source software.

efdee 9y ago
That's how the theory goes, but how often does this really happen though? See: OpenSSL
- tptacek 9y ago
  The simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.
  - bitmapbrother 9y ago
    Google's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.
    - lawnchair_larry 9y ago
      Hehe, "favor"
- skrebbel 9y ago
  On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
  - sand500 9y ago
    Is github itself open source tho?
    - jtl999 9y ago
      Well I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)

cgb223 9y ago

Maybe we should start some sort of foundation dedicated to providing the same incentive to find bugs in OSS I'd imagine there are a lot of programmers who would be interested in supporting something like this

dsacco 9y ago
You mean something like The Internet Bug Bounty?

43gg43g32g 9y ago

OSS already had bug bounties a long time ago.

markstos 9y ago

Many companies large and small already pay penetration testers to try into break into their Linux-based servers on a regular basis. I was personally involved in a case where a recognizable brand's pen testing effort lead to a fix a well-used piece of open source software. There is a lot of open source is already being fixed thanks to commercial interests.

kazinator 9y ago

To begin with, some OSS doesn't even know how to treat people who report bugs.

gerdesj 9y ago
Citation needed
- deleted 9y ago
  [deleted]
detaro 9y ago
The average OSS project probably is better about that than the average software company though - at least with OSS projects you can be reasonably secure that they won't send lawyers or the police after you for finding bugs.
- yorwba 9y ago
  It is also easier for an outsider to figure out where to report the bug. I had a bug using NLTK to display parse trees in Jupyter notebooks. NLTK uses tkinter to render the parse trees to PostScript and GhostScript to produce a png image. The chain broke when the PostScript output had a font size of 0. If this had been a bug in a closed-source program, all I could have put in a bug report would have been "doesn't work, pls fix". Instead, I could submit a workaround to NLTK and start looking for the reason tkinter generated malformed PostScript output. This turned out to be because Tcl/Tk's font handling used Xft, which used FontConfig, and used an integer for the font size where FontConfig expected a double. Everything worked fine until FontConfig started doing floating point math on the font size. The Tk maintainer who triaged my bug report couldn't even reproduce it on his system, because his version of FontConfig only ever copied the value. Only because every component of the chain was open source, was it possible to track the bug down and fix it.

gerdesj 9y ago

"OSS can't afford to pay people" You don't really understand how open source works, do you? cough shill cough. The source is free but you are also free to build consultancy etc on the back of it. "I wonder if there will exist ... yield better (less buggy) software vs OSS." - RLY?

runeks 9y ago

> OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can. Software insurance companies can invest a part of the insurance premium on OSS in bug bounties. It’s a shame more people aren’t aware of software insurance, since OSS has several advantages in this area, for example that the source code is available to everyone, such that insurance companies can pay everyone in the world to find bugs in the software they’re insuring. That’s a definite advantage. It’s not often that an insurance company has the opportunity to invite everyone in the world to help them assess the quality of what they’re insuring.

nsgi 9y ago

Mozilla has a bug bounty.