4 ms·
Bug bounties are good but they wouldn't have prevented Spectre-Meltdown. The only way to prevent such a fiasco is for the bugs to never exist in the first place
by mastax 9y ago
Bug bounties are good but they wouldn't have prevented Spectre-Meltdown. The only way to prevent such a fiasco is for the bugs to never exist in the first place. The only difference bounties make is that hopefully vendors patch the issue before it becomes widely exploited. In the case of S/M, vendors got many months of notice and it was still a fiasco - that is the nature of software bugs.
- whb07 9y agoFor bugs to never exist in the first place? Let me put that one in the list of obvious things like “traffic accidents shouldn’t occur”, “drowning accidents shouldn’t occur”, “heart disease shouldn’t occur”. I’m sure I missed something. Could you help me out ?
- mastax 9y agoI was just taking issue with the title. Bug bounties don't make bugs go away.
- ploxiln 9y agoMeltdown/Spectre was not a "fiasco" due to Microsoft and Intel not finding out. It was "responsibly" disclosed to the companies, and there were multiple months to prepare a response. A bigger bounty would not change anything for Meltdown/Spectre. It was a "fiasco" because it affected over 90% of all servers and laptops out there. And there was just no way to prepare enough of a response, while keeping it secret. For a few months, too few engineers knew about it for good mitigation development. Towards the end, as more people who needed to know were looped in, everyone could see it coming. The vulnerabilities, and mitigations, were just too big.
- icebraining 9y agoThey wouldn't have prevented the bug, but they might have prevented the size of the fiasco, if they were found earlier, before everyone switched to vulnerable CPUs.