4 ms·

>This makes me sad. People working on open source projects get nothing. Sometimes they get some money. Sometimes they get some fame. People who don't build anyt

>This makes me sad. People working on open source projects get nothing. Sometimes they get some money. Sometimes they get some fame. People who don't build anything, but find a hole, they are heroes, they get prizes, they are worshiped. I think you've misunderstood what's happening here. Zerodium, the company mentioned in this article, is an exploit broker. They buy vulnerabilities from researchers, then sell them on to government intelligence agencies. The entire purpose of their business is to undermine the security of the tools we use. Bug bounties are a response to this trade in exploits. They incentivise researchers to publish vulnerabilities rather than selling them to spies. They're a necessary evil to keep zero-day vulnerabilities out of the hands of oppressive regimes. It's not nice, but that's just the world we live in. Large companies that rely on open source software have started to understand the importance of financially supporting OSS development, largely as a result of the Heartbleed crisis. The Linux Foundation's Core Infrastructure Initiative has created a secure financial foundation for critical open source projects.

pleasecalllater 8y ago
I understood. That was just my thought about the whole situation where you can earn on finding bugs, not on writing reliable software.
xxs 8y ago
> They buy vulnerabilities from researchers... or provide an opportunity for the original developers to introduce an obscure backdoor and cash out
- pas 8y ago
  That's an interesting take on the situation. Was there any instance of this? Are there disincentives against this? (I guess the entity offering the bounty could say, only software released before this day is available. Though malicious contributors can very certainly guess that there will be other future bug bounties too.)
  - Zophike1 8y ago
    > Was there any instance of this? Are there disincentives against this? (I guess the entity offering the bounty could say, only software released before this day is available. Though malicious contributors can very certainly guess that there will be other future bug bounties too.) I believe sometime ago there was new surrounding backdoored crypto also on the low-level side of things there was a secret rootkit in Street Fighter that allowed for an EOP https://github.com/FuzzySecurity/Capcom-Rootkit https://github.com/FuzzySecurity/Capcom-Rootkit https://www.blackhat.com/docs/eu-17/materials/eu-17-Filiol-By-Design-Backdooring-Of-Encryption-System-Can-We-Trust-Foreign-Encryption-Algorithms.pdf https://www.blackhat.com/docs/eu-17/materials/eu-17-Filiol-B...
- rv77ax 8y ago
  Impossible. Our ego is too high to allow bug in our code.
  - lowry 8y ago
    Higher than a pile of banknotes that together make half a million dollars? I doubt that.
pjmlp 8y ago
Companies like Zerodium profit from the languages many insist in using for writing such systems. History of security improvements in UNIX derived OSes is building band ainds to work around it.
Zophike1 8y ago
> I think you've misunderstood what's happening here. Zerodium, the company mentioned in this article, is an exploit broker. They buy vulnerabilities from researchers, then sell them on to government intelligence agencies. The entire purpose of their business is to undermine the security of the tools we use. It's not only Zerodium there are a lot of government contractors who buy/fund attack research especially in things like Theoretical Cryptography, Machine Learning, Computer Vision, Formal Verification. > They incentivise researchers to publish vulnerabilities rather than selling them to spies. They're a necessary evil to keep zero-day vulnerabilities out of the hands of oppressive regimes. It's not nice, but that's just the world we live in. I think it's quite interesting that we don't see Bug bounties for things like Theoretical Cryptography like Quantum-safe encryption, Formal Verification, and the like. But hasn't there been cases where Bug bounties have been subverted for evil or are just broken entirely. > The Linux Foundation's Core Infrastructure Initiative has created a secure financial foundation for critical open source projects. For critical open source projects hasn't there been an increase in Formal Verification and more Theoretical approaches to security ?

pleasecalllater 8y ago

I understood. That was just my thought about the whole situation where you can earn on finding bugs, not on writing reliable software.

xxs 8y ago

> They buy vulnerabilities from researchers... or provide an opportunity for the original developers to introduce an obscure backdoor and cash out

pas 8y ago
That's an interesting take on the situation. Was there any instance of this? Are there disincentives against this? (I guess the entity offering the bounty could say, only software released before this day is available. Though malicious contributors can very certainly guess that there will be other future bug bounties too.)
- Zophike1 8y ago
  > Was there any instance of this? Are there disincentives against this? (I guess the entity offering the bounty could say, only software released before this day is available. Though malicious contributors can very certainly guess that there will be other future bug bounties too.) I believe sometime ago there was new surrounding backdoored crypto also on the low-level side of things there was a secret rootkit in Street Fighter that allowed for an EOP https://github.com/FuzzySecurity/Capcom-Rootkit https://github.com/FuzzySecurity/Capcom-Rootkit https://www.blackhat.com/docs/eu-17/materials/eu-17-Filiol-By-Design-Backdooring-Of-Encryption-System-Can-We-Trust-Foreign-Encryption-Algorithms.pdf https://www.blackhat.com/docs/eu-17/materials/eu-17-Filiol-B...
rv77ax 8y ago
Impossible. Our ego is too high to allow bug in our code.
- lowry 8y ago
  Higher than a pile of banknotes that together make half a million dollars? I doubt that.

pjmlp 8y ago

Companies like Zerodium profit from the languages many insist in using for writing such systems. History of security improvements in UNIX derived OSes is building band ainds to work around it.

Zophike1 8y ago

> I think you've misunderstood what's happening here. Zerodium, the company mentioned in this article, is an exploit broker. They buy vulnerabilities from researchers, then sell them on to government intelligence agencies. The entire purpose of their business is to undermine the security of the tools we use. It's not only Zerodium there are a lot of government contractors who buy/fund attack research especially in things like Theoretical Cryptography, Machine Learning, Computer Vision, Formal Verification. > They incentivise researchers to publish vulnerabilities rather than selling them to spies. They're a necessary evil to keep zero-day vulnerabilities out of the hands of oppressive regimes. It's not nice, but that's just the world we live in. I think it's quite interesting that we don't see Bug bounties for things like Theoretical Cryptography like Quantum-safe encryption, Formal Verification, and the like. But hasn't there been cases where Bug bounties have been subverted for evil or are just broken entirely. > The Linux Foundation's Core Infrastructure Initiative has created a secure financial foundation for critical open source projects. For critical open source projects hasn't there been an increase in Formal Verification and more Theoretical approaches to security ?