12 ms·

EU to fund bug bounty programs for open-source projects

459 points by svenfaw 8y ago

rasengan 8y ago
This is a good step, and it’s great glibc is included. In the future, I think it would be great if more critical, widely distributed libraries/software could be included like that!
- dhh2106 8y ago
  +1 It's a good initiative and needs a better selection / qualification process
uh_what 8y ago
Seems like it would quite easy to game the system. Make contributions with known vulnerabilities and then submit an anonymous bug report when the contribution is approved.
- deleted 8y ago
  [deleted]
- eikenberry 8y ago
  I think the community would keep this to a minimum just through normal peer pressure and shaming.
  - emn13 8y ago
    And most open source projects run a fairly transparent dev process - almost by necessity. Doing something like that as an individual dev might be possible, but hard and likely impossible to do structurally (no guarantee to get it in, no guarantee for the project to be picked next year(s), no guarantee for nobody else to find it first, and upon discovery, risk that your scam becomes apparent). But as a team, the only way to really pull this off involves inserting such vulnerabilities intentionally and out of sight, which means a closed dev process. Even if you orchestrate via some other medium - assuming you're using a VCS, the vulnerability will be publicly traceable to a core contributor - and if you do that regularly, you'll at the become known as a project that's a security nightmare; that might kill the project in the long run. And you might even raise suspicions purely base on the frequency and nature of vulnerabilities. All in all: abusing this sounds like a fairly risky fraud.
    - tchaffee 8y ago
      Lots of fraud is risky. And often very worth it if you are very poor and live in a country where laws against fraud aren't enforced. I think the potential for abuse deserves a closer look.
  - tchaffee 8y ago
    In order for that to happen, someone has to get caught. I think this opportunity for abuse deserves some more careful thought about how to prevent it.
    - greglindahl 8y ago
      People have thought about how to prevent it -- it's not a new issue.
      - tchaffee 8y ago
        In that case could you provide a source or two for those of us who want to get up to date with the current thinking?
        greglindahl 8y ago
        Here's one example, you can find many more with a little googling: https://stackoverflow.com/a/39708317/1370917 https://stackoverflow.com/a/39708317/1370917 If you look at the question, you can see that some people don't make the connection that the motivation behind code signing is figuring out who committed suspicious code. Code that has security bugs is one interest, another is code which the committer didn't have permission to commit, for example proprietary code.
        tchaffee 8y ago
        Thanks for the link. So I submit some code that is signed and it's a good contribution that closes an issue. I intentionally include a subtle bug. My friend who lives in a different country uses the bug bounty program to fix the bug and he collects the money. How do you detect that scenario with code signing?
- blackoil 8y ago
  Easier is to join a company which pays for development.
  - tchaffee 8y ago
    If you live in a developed country.
- uh_what 8y ago
  Follow up: This situation is similar to when England wanted Delhi to be rid of cobras so they started offering rewards for dead cobras. The citizens of Delhi responded to this incentive by farming cobras. What's the difference? It's a systemic flaw. If there exists an incentive for finding vulnerabilities, there exists an incentive for introducing vulnerabilities. Bug bounties work great for closed source companies because there doesn't exist a misalignment of incentives. If Johnny keeps writing buggy code, he gets fired. If anonymous234 gets his buggy pull request approved, confederate anonymous456 gets to make a few bucks. Follow up #2: For the skeptical downvoters, I'll put my money where my mouth is and attempt to capture the bounties using the method described above.
  - justinclift 8y ago
    > Follow up #2: For the skeptical downvoters, I'll put my money where my mouth is and attempt to capture the bounties using the method described above. Please don't.
29athrowaway 8y ago
What if they took all the office suite licenses budget and they invested it in an open source office suite project like LibreOffice, Caligra suite (formerly KOffice) or Gnome Office.
- scrollaway 8y ago
  Why not both? FYI a lot of european government offices run LibreOffice.
- sddfd 8y ago
  The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux https://en.m.wikipedia.org/wiki/LiMux
  - em3rgent0rdr 8y ago
    Munich did that, but they didn't do the second part of parent's suggestion: "and they invested it in an open source office suite..." Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs.
    - lbeltrame 8y ago
      > Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs. Actually LiMux did that. From an external PoV, I saw quite a number of commits coming from LiMux sponsored people in a few FOSS projects I follow.
    - scirocco 8y ago
      Yup. Going open source requires a shift in mindset when handling support issues. Coming from a paralyzed, complaining-to-vendor position, into taking responsibility and fixing the problems yourself.
    - johannes1234321 8y ago
azdacha 8y ago
Why PHP & Symphony ? This joke which is getting way too far. I'm getting tired of seeing it, and I'm tired of arguing why sticking with a language like that is a mistake. Bug Bounties are great, but I'd like to see people put their brain on for a moment and stop relying on what they learnt when they were 14 neither propose it as a valid solution today or encourage other people to use them. I'm getting very tired of this sh*t.
- jabl 8y ago
  The list reads like the EU commission surveyed what they had running on dusty forgotten servers in some closet. The idea per se is good, though. We need to ensure that foundational infrastructure is properly maintained.
- the_duke 8y ago
  PHP is used for a massive amount of software out there. I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact. From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in. Regardless of how much you don't like PHP.
  - azdacha 8y ago
    I very well know how much PHP is used. However the possibilities and outcomes a learning developper has by choosing PHP are very well enclosed to the few things PHP gives instead of the myriads of things other tools offer. I won't even talk about the semantic. On the other hand letting the dev learn JS or Python or even C++ in a pre-thought way will let much more different technologies and "tech-area" to their grasp instead of getting enclosed in the almighty web jobs. You'll start hating PHP when you'll get friends who loose all interest in programming by choosing to earn their life satisfied of themselves for the few buks they earned. I'm not satisfied of what PHP gives, neither what I can do with it. Why would I learn PHP if I know Python and C & JS ? I don't see any except for the one you told me which is that it is used by plenty of software and that it is very popular. However, every main tech that is released today is released with a Python API or JS API. So tell me, Why the hell would you tell somebody to enclose himself in this tool other than earning a few easy buks or working for another web company ? So I can tell him to build some weird hook to use the main techs ? So I can tell him we did no investment on architecture other than money ? I cannot think of PHP companies as something else than a no-innovation, no-research, no-interest & no change since 2000's. Hell maybe upgrade the one framework used one more time that may do ? Go Python you have access to Data science, web dev, all unix things and accessible, hell you can even try to make a little game with it. Go JS, you also have access to myriad of stuff, I won't even have to say how much. Now please tell me what I can do with PHP, I want to see newcomers read what options you have by learning PHP. PLEASE.
jabl 8y ago
Is it worth to spend 90kEUR on putty, considering windows nowadays has openssh?
- scrollaway 8y ago
  Is it worth spending money on Drupal considering we nowadays have anything else? The answer is yes. The value of these bug bounty programs is directly tied to the amount of use the software gets (and most of these get used a ton, including Putty, regardless of alternatives).
  - oelmekki 8y ago
    Do people using these oldish softwares update them, though? Funding bug bounty programs kind of fail its objectives if they don't.
    - scrollaway 8y ago
      You're not wrong, but those are still separate issues. In the context of benefit for the government itself, you'd certainly hope so… Regardless of whether they get updated, these are still a net benefit for new installs.
      - oelmekki 8y ago
        Oh indeed, I'm not trying to say they should not fund these programs, this is awesome and welcome. I'm just warning about a possible pitfall for them to keep an eye on :)
- threeseed 8y ago
  Most places are not running the latest version of Windows. And even if their SOE is Windows 10 I guarantee you that their VDI isn't. And since Putty doesn't need an installer it's easy for users to install themselves even when the machines are locked down. So given that pretty much every government/company probably has some incidental security exposure to Putty it is a smart investment to make sure it's bug free.
em3rgent0rdr 8y ago
Notepad++ seems to be only Windows. Seems would be better to support a cross-platform text editor.
- r3bl 8y ago
  It also seems to be the third most popular dev environment overall (behind VS and VS Code, ahead of Sublime Text and Vim): https://insights.stackoverflow.com/survey/2018/#development-environments-and-tools https://insights.stackoverflow.com/survey/2018/#development-... It's not a very interesting target (most of these are not), but it's safe to say it's a valid target.
  - deleted 8y ago
    [deleted]
- blackoil 8y ago
  I believe Software are selected based on the usage. So if it is most used editor, they should sponsor it irrespective of the OS.
- threeseed 8y ago
  You have it backwards. It isn't about promoting open source products. It's about defending against open source products that are already being used. Likely heavily used within the EU institution itself.
- qha 8y ago
  Of that list, Notepad++ is the only product I use, so I'm happy with their decision :D
offsetr 8y ago
For so much austerity this is insulting.
- Jonnax 8y ago
  Investment in technology should stop because of austerity? Is that a good solution to drive economic advancement?
ngcc_hk 8y ago
Excellent. Less free rider better public good.
tbarbugli 8y ago
Great idea, I hope they also put money to help get orgs out of PHP, Drupal and other dead/terrible software. If not this is a bit depressing and short sighted.
- stefkors 8y ago
  What would be good alternatives for php and drupal?
  - justinclift 8y ago
    Nginx and Hugo, depending on whether the website really needs that backend database or not. eg Hugo does static websites, but obviously that doesn't meet the needs of everyone. :)
- kyriakos 8y ago
  Why would they get out of PHP?
  - tbarbugli 8y ago
    Do I really have to explain this?
    - kyriakos 8y ago
      Yes, if you have an application running on a currently supported platform why would you want to move away from it?
    - calibas 8y ago
      PHP has matured greatly since version 5, especially in terms of performance, and Drupal 8 is a top choice for creating enterprise-level APIs. Neither is dead and Drupal is only "terrible" for beginners. By most measurements, PHP is used by a majority of sites on the internet. The worst part is how many of those still use PHP 5, which reaches end of life tomorrow...
halfastack 8y ago
This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE protocols and procedures. The idea probably is to curb the zero-day vulnerability leaks, but I assume that if you're able to find a CVE, you're capable of finding a CVE procedure. Overall, though, this is great of course.
- kyriakos 8y ago
  Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.
  - progval 8y ago
    > which have records of bugs have causing them problems even glibc? > I can't see how VLC can be as mission critical as Kafka. VLC can run on public screens
    - CJefferson 8y ago
      A friend of mine spent last Christmas debugging an issue in memcpy in glibc (on Intel 32-bit CPUs). Glibc is less well tested than I expected, and has ASM implementations of many functions for many CPUs, some of which are (obviously) less well supported than others.
      - int0x80 8y ago
        IA32 is probably not getting all the focus from devs and users this days, still surprising whoever... Do you have a link to the issue, out of curiosity?
interfixus 8y ago
My disillusion and cynicism know few bounds in any matter involving the EU (or any political body, for that matter). Over the years, something like this could easily morph into 'this open source software certified and legal to use within the EU'.
- vertex-four 8y ago
  The EU has been funding the development of open source software through grants for many years now.
  - interfixus 8y ago
    Yes, I know. And?
    - Jonnax 8y ago
      What you said hasn't happened.
      - interfixus 8y ago
        Silly me. What hasn't happened, never will happen. Sorry. No governing body will ever threaten software freedom.
        vertex-four 8y ago
        No, but you’ve got to have an argument for why this particular round of funding is somehow different from the others which haven’t led to what you suggest so far - what is it? Or is there some general argument for why the EU funding open source software will lead to our demise? Does this round mark a specific point in the journey to free software being made illegal? “Governments funding open source software is bad because reasons” isn’t really a useful post on Hacker News.
  - conanthe 8y ago
    The EU funds nothing, it is the tax-payer.
conanthe 8y ago
EU or the tax-payer without being asked? They are getting really smug with their propaganda and have no accountability.
- Jonnax 8y ago
  You seem to fundamentally misunderstand what the EU does. Each country funds the EU, it creates laws and also has programmes across the member countries. Each country elects Members of the European Parliament. No country in the EU is a direct democracy where the public vote on every decision. They elect a politician to make those decisions for them. Do you complain when your local government builds a road to someone you don't want to go?
  - conanthe 8y ago
    MEPs don't create laws. They make part of the deception. The body that shapes the EU and decides nonsense like this is unelected.
justinclift 8y ago
This all sounds good, with the exception of FileZilla, who (still) distribute malware ("bundled ad offers") with their default Windows downloads. :( Seems kind of bizarre the EU would encourage such practises.
- cyphar 8y ago
  I think it's a stretch to say that the EU is "encouraging" such scummy practices. It's likely that they just collated a list of all software used widely by government departments within the EU -- and thus FileZilla is on the list. Ultimately, a potential 0day causing RCE within a government department is more of a concern to the EU than the optional malware you get during FileZilla's installation.
  - justinclift 8y ago
    > the optional malware you get during FileZilla's installation. Think that through. The malware that comes with FileZilla is often reported to be pretty bad. Agreed, potential a 0 day (especially when targeted) could also have a really bad effect. But Filezilla's malware isn't theoretical, so could really be the bigger problem.
    - cyphar 8y ago
      I haven't used Filezilla in a _long_ time -- is the malware optional? I imagine that most EU governments image their machines, so they IT departments likely aren't installing the malware. And there is also the consideration that governments will continue to use Filezilla even if there isn't EU funding to make it more secure -- malware and all.
      - justinclift 8y ago
        Good points. Yeah, I'd hope it's the IT departments doing images, rather than end users being able to install things.
thorin1 8y ago
Never heard about "Digital Signature Services (DSS), FLUX TL, midPoint, WSO2". Why were they chosen?
- BucketSort 8y ago
  As others have said, they are most likely being used by the EU in some parts of their infrastructure. Then the question becomes "Why were they using these software in their infrastructure?" The answer to that is probably along the lines of "a guy that was assigned to project used it because it came up in google," if I were to hazard a guess.
  - pergadad 8y ago
    Isn't this how most software is chosen? Someone finds it, realises it's useful, recommends it further, ... And down the line it's an essential tool.
- kozziollek 8y ago
  DSS is EU-owned library I believe. I used it instead reimplementing digital signature verification for XMLs, PDFs, hadling certificate revocation, etc. Makes sense that they want to secure own library that secures many other applications. WSO2 is Enterprise Service Bus that I used at another company (owned by government BTW) instead of one from whoever-makes-commercial-ESBs.
  - cs747 8y ago
    WSO2 is more than just Enterprise Service Bus. There are a bunch of products and solutions belongs to WSO2[1]. Enterprise Service Bus, API Gateway, Identity and Acess Manager, Analytics and Stream Processing Server are the core products. [1] https://wso2.com/platform https://wso2.com/platform
pacifika 8y ago
https://etendering.ted.europa.eu/cft/cft-display.html?cftId=3375 https://etendering.ted.europa.eu/cft/cft-display.html?cftId=... I process was open tender from which the software projects were chosen.
talltimtom 8y ago
So now the game for developers is to include intentional but sufficiently abscure bugs that they can harvest money off down the line.
- trulyrandom 8y ago
  I don't think developers would be eligible for bounties for vulnerabilities found in their own projects.
  - Ace17 8y ago
    Probably not. However, such a limitation is rather easy to workaround. Which means now, buggy commits are going to look suspicous.
  - talltimtom 8y ago
    So? You sell your exploits to another dev at a fraction of the bounty, other devs so the same for you. It’s not like that puts up any real obstacle.
alkonaut 8y ago
They should put the money towards paid maintainers instead (or also).
cannedslime 8y ago
Even as a life long EU skeptic, I'm okay with this. Im not sure about the choice of projects, but I'm sure someone had their reasons for picking the projects that I don't find particularly relevant for a public funded bug bounty. Eg. Im sure that Notepad++ has its share of bugs, but I doubt many are critical or security related.
based2 8y ago
https://media.ccc.de/v/062_Hacking_EU_funding_for_a_FOSS_project https://media.ccc.de/v/062_Hacking_EU_funding_for_a_FOSS_pro...
Proven 8y ago
They fund open source projects and now they fund bug submissions and fixes too. I'd be surprised if this bureaucrat-driven innovation doesn't result in the same people producing shitty OSS and then claiming bug bounties through their cousins in Bulgaria. The EU is ruled by a mix of quasi-capitalist thieves, and socialist morons who fancy central planning. What they're doing is not only against the spirit of OSS but an abomination of "free" (the licenses may be "free" but it's all funded through state theft and involuntary taxes!)
_pmf_ 8y ago
Targeting existing projects has the advantage of creating fewer perverse incentives. EU funds for open ended projects are notorious for being leeched.
- jimnotgym 8y ago
  > EU funds for open ended projects are notorious for being leeched Can you give some examples please?
rendx 8y ago
The European Commission also has additional calls out for intermediaries to re-distribute funding to open source projects (ICT24), and some of the intermediaries have their respective calls open for projects (from 5k€ to 200k€): https://www.ngi.eu/opencalls/ https://www.ngi.eu/opencalls/ https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/topic-details/ict-24-2018-2019 https://ec.europa.eu/info/funding-tenders/opportunities/port...
garfieldnate 8y ago
Wow, this is great! I wish the US did this!

459 points by svenfaw 8y ago

This is a good step, and it’s great glibc is included. In the future, I think it would be great if more critical, widely distributed libraries/software could be included like that!

dhh2106 8y ago
+1 It's a good initiative and needs a better selection / qualification process

uh_what 8y ago

Seems like it would quite easy to game the system. Make contributions with known vulnerabilities and then submit an anonymous bug report when the contribution is approved.

deleted 8y ago
[deleted]
eikenberry 8y ago
I think the community would keep this to a minimum just through normal peer pressure and shaming.
- emn13 8y ago
  And most open source projects run a fairly transparent dev process - almost by necessity. Doing something like that as an individual dev might be possible, but hard and likely impossible to do structurally (no guarantee to get it in, no guarantee for the project to be picked next year(s), no guarantee for nobody else to find it first, and upon discovery, risk that your scam becomes apparent). But as a team, the only way to really pull this off involves inserting such vulnerabilities intentionally and out of sight, which means a closed dev process. Even if you orchestrate via some other medium - assuming you're using a VCS, the vulnerability will be publicly traceable to a core contributor - and if you do that regularly, you'll at the become known as a project that's a security nightmare; that might kill the project in the long run. And you might even raise suspicions purely base on the frequency and nature of vulnerabilities. All in all: abusing this sounds like a fairly risky fraud.
  - tchaffee 8y ago
    Lots of fraud is risky. And often very worth it if you are very poor and live in a country where laws against fraud aren't enforced. I think the potential for abuse deserves a closer look.
- tchaffee 8y ago
  In order for that to happen, someone has to get caught. I think this opportunity for abuse deserves some more careful thought about how to prevent it.
  - greglindahl 8y ago
    People have thought about how to prevent it -- it's not a new issue.
    - tchaffee 8y ago
      In that case could you provide a source or two for those of us who want to get up to date with the current thinking?
      - greglindahl 8y ago
        Here's one example, you can find many more with a little googling: https://stackoverflow.com/a/39708317/1370917 https://stackoverflow.com/a/39708317/1370917 If you look at the question, you can see that some people don't make the connection that the motivation behind code signing is figuring out who committed suspicious code. Code that has security bugs is one interest, another is code which the committer didn't have permission to commit, for example proprietary code.
        tchaffee 8y ago
        Thanks for the link. So I submit some code that is signed and it's a good contribution that closes an issue. I intentionally include a subtle bug. My friend who lives in a different country uses the bug bounty program to fix the bug and he collects the money. How do you detect that scenario with code signing?
blackoil 8y ago
Easier is to join a company which pays for development.
- tchaffee 8y ago
  If you live in a developed country.
uh_what 8y ago
Follow up: This situation is similar to when England wanted Delhi to be rid of cobras so they started offering rewards for dead cobras. The citizens of Delhi responded to this incentive by farming cobras. What's the difference? It's a systemic flaw. If there exists an incentive for finding vulnerabilities, there exists an incentive for introducing vulnerabilities. Bug bounties work great for closed source companies because there doesn't exist a misalignment of incentives. If Johnny keeps writing buggy code, he gets fired. If anonymous234 gets his buggy pull request approved, confederate anonymous456 gets to make a few bucks. Follow up #2: For the skeptical downvoters, I'll put my money where my mouth is and attempt to capture the bounties using the method described above.
- justinclift 8y ago
  > Follow up #2: For the skeptical downvoters, I'll put my money where my mouth is and attempt to capture the bounties using the method described above. Please don't.

29athrowaway 8y ago

What if they took all the office suite licenses budget and they invested it in an open source office suite project like LibreOffice, Caligra suite (formerly KOffice) or Gnome Office.

scrollaway 8y ago
Why not both? FYI a lot of european government offices run LibreOffice.
sddfd 8y ago
The city of Munich tried to develop a Linux distribution "Limux" that was used for some time, but political considerations ultimately reversed the decision. https://en.m.wikipedia.org/wiki/LiMux https://en.m.wikipedia.org/wiki/LiMux
- em3rgent0rdr 8y ago
  Munich did that, but they didn't do the second part of parent's suggestion: "and they invested it in an open source office suite..." Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs.
  - lbeltrame 8y ago
    > Surely most of the problems with the opensource tools they were using could have been resolved by helping the opensource projects fix bugs. Actually LiMux did that. From an external PoV, I saw quite a number of commits coming from LiMux sponsored people in a few FOSS projects I follow.
  - scirocco 8y ago
    Yup. Going open source requires a shift in mindset when handling support issues. Coming from a paralyzed, complaining-to-vendor position, into taking responsibility and fixing the problems yourself.
  - johannes1234321 8y ago

azdacha 8y ago

Why PHP & Symphony ? This joke which is getting way too far. I'm getting tired of seeing it, and I'm tired of arguing why sticking with a language like that is a mistake. Bug Bounties are great, but I'd like to see people put their brain on for a moment and stop relying on what they learnt when they were 14 neither propose it as a valid solution today or encourage other people to use them. I'm getting very tired of this sh*t.

jabl 8y ago
The list reads like the EU commission surveyed what they had running on dusty forgotten servers in some closet. The idea per se is good, though. We need to ensure that foundational infrastructure is properly maintained.
the_duke 8y ago
PHP is used for a massive amount of software out there. I hate the language as much as anyone (probably more since I had to work with it extensively), but that doesn't change the above fact. From Wordpress and Drupal to countless custom websites and apps built with Laravel or Symfony, this is a very worthwhile area to invest this money in. Regardless of how much you don't like PHP.
- azdacha 8y ago
  I very well know how much PHP is used. However the possibilities and outcomes a learning developper has by choosing PHP are very well enclosed to the few things PHP gives instead of the myriads of things other tools offer. I won't even talk about the semantic. On the other hand letting the dev learn JS or Python or even C++ in a pre-thought way will let much more different technologies and "tech-area" to their grasp instead of getting enclosed in the almighty web jobs. You'll start hating PHP when you'll get friends who loose all interest in programming by choosing to earn their life satisfied of themselves for the few buks they earned. I'm not satisfied of what PHP gives, neither what I can do with it. Why would I learn PHP if I know Python and C & JS ? I don't see any except for the one you told me which is that it is used by plenty of software and that it is very popular. However, every main tech that is released today is released with a Python API or JS API. So tell me, Why the hell would you tell somebody to enclose himself in this tool other than earning a few easy buks or working for another web company ? So I can tell him to build some weird hook to use the main techs ? So I can tell him we did no investment on architecture other than money ? I cannot think of PHP companies as something else than a no-innovation, no-research, no-interest & no change since 2000's. Hell maybe upgrade the one framework used one more time that may do ? Go Python you have access to Data science, web dev, all unix things and accessible, hell you can even try to make a little game with it. Go JS, you also have access to myriad of stuff, I won't even have to say how much. Now please tell me what I can do with PHP, I want to see newcomers read what options you have by learning PHP. PLEASE.

jabl 8y ago

Is it worth to spend 90kEUR on putty, considering windows nowadays has openssh?

scrollaway 8y ago
Is it worth spending money on Drupal considering we nowadays have anything else? The answer is yes. The value of these bug bounty programs is directly tied to the amount of use the software gets (and most of these get used a ton, including Putty, regardless of alternatives).
- oelmekki 8y ago
  Do people using these oldish softwares update them, though? Funding bug bounty programs kind of fail its objectives if they don't.
  - scrollaway 8y ago
    You're not wrong, but those are still separate issues. In the context of benefit for the government itself, you'd certainly hope so… Regardless of whether they get updated, these are still a net benefit for new installs.
    - oelmekki 8y ago
      Oh indeed, I'm not trying to say they should not fund these programs, this is awesome and welcome. I'm just warning about a possible pitfall for them to keep an eye on :)
threeseed 8y ago
Most places are not running the latest version of Windows. And even if their SOE is Windows 10 I guarantee you that their VDI isn't. And since Putty doesn't need an installer it's easy for users to install themselves even when the machines are locked down. So given that pretty much every government/company probably has some incidental security exposure to Putty it is a smart investment to make sure it's bug free.

em3rgent0rdr 8y ago

Notepad++ seems to be only Windows. Seems would be better to support a cross-platform text editor.

r3bl 8y ago
It also seems to be the third most popular dev environment overall (behind VS and VS Code, ahead of Sublime Text and Vim): https://insights.stackoverflow.com/survey/2018/#development-environments-and-tools https://insights.stackoverflow.com/survey/2018/#development-... It's not a very interesting target (most of these are not), but it's safe to say it's a valid target.
- deleted 8y ago
  [deleted]
blackoil 8y ago
I believe Software are selected based on the usage. So if it is most used editor, they should sponsor it irrespective of the OS.
threeseed 8y ago
You have it backwards. It isn't about promoting open source products. It's about defending against open source products that are already being used. Likely heavily used within the EU institution itself.
qha 8y ago
Of that list, Notepad++ is the only product I use, so I'm happy with their decision :D

offsetr 8y ago

For so much austerity this is insulting.

Jonnax 8y ago
Investment in technology should stop because of austerity? Is that a good solution to drive economic advancement?

ngcc_hk 8y ago

Excellent. Less free rider better public good.

tbarbugli 8y ago

Great idea, I hope they also put money to help get orgs out of PHP, Drupal and other dead/terrible software. If not this is a bit depressing and short sighted.

stefkors 8y ago
What would be good alternatives for php and drupal?
- justinclift 8y ago
  Nginx and Hugo, depending on whether the website really needs that backend database or not. eg Hugo does static websites, but obviously that doesn't meet the needs of everyone. :)
kyriakos 8y ago
Why would they get out of PHP?
- tbarbugli 8y ago
  Do I really have to explain this?
  - kyriakos 8y ago
    Yes, if you have an application running on a currently supported platform why would you want to move away from it?
  - calibas 8y ago
    PHP has matured greatly since version 5, especially in terms of performance, and Drupal 8 is a top choice for creating enterprise-level APIs. Neither is dead and Drupal is only "terrible" for beginners. By most measurements, PHP is used by a majority of sites on the internet. The worst part is how many of those still use PHP 5, which reaches end of life tomorrow...

halfastack 8y ago

This is a very strange distribution of projects. There are projects like VLC, Filezilla, and 7-zip, next to often mission-critical pieces of software, like Kafka, Tomcat, and GlibC. I wonder what went into the decision process to include each of these libraries. I also dislike the 'bug bounty platforms'. Why can't I simply report it upstream, and if accepted, claim my price? Each of the projects should have CVE protocols and procedures. The idea probably is to curb the zero-day vulnerability leaks, but I assume that if you're able to find a CVE, you're capable of finding a CVE procedure. Overall, though, this is great of course.

kyriakos 8y ago
Most probably these are tools commonly used by EU institutions which have records of bugs have causing them problems. The solution is to help fix those bugs by offering money. You are right though, I can't see how VLC can be as mission critical as Kafka.
- progval 8y ago
  > which have records of bugs have causing them problems even glibc? > I can't see how VLC can be as mission critical as Kafka. VLC can run on public screens
  - CJefferson 8y ago
    A friend of mine spent last Christmas debugging an issue in memcpy in glibc (on Intel 32-bit CPUs). Glibc is less well tested than I expected, and has ASM implementations of many functions for many CPUs, some of which are (obviously) less well supported than others.
    - int0x80 8y ago
      IA32 is probably not getting all the focus from devs and users this days, still surprising whoever... Do you have a link to the issue, out of curiosity?

interfixus 8y ago

My disillusion and cynicism know few bounds in any matter involving the EU (or any political body, for that matter). Over the years, something like this could easily morph into 'this open source software certified and legal to use within the EU'.

vertex-four 8y ago
The EU has been funding the development of open source software through grants for many years now.
- interfixus 8y ago
  Yes, I know. And?
  - Jonnax 8y ago
    What you said hasn't happened.
    - interfixus 8y ago
      Silly me. What hasn't happened, never will happen. Sorry. No governing body will ever threaten software freedom.
      - vertex-four 8y ago
        No, but you’ve got to have an argument for why this particular round of funding is somehow different from the others which haven’t led to what you suggest so far - what is it? Or is there some general argument for why the EU funding open source software will lead to our demise? Does this round mark a specific point in the journey to free software being made illegal? “Governments funding open source software is bad because reasons” isn’t really a useful post on Hacker News.
- conanthe 8y ago
  The EU funds nothing, it is the tax-payer.

conanthe 8y ago

EU or the tax-payer without being asked? They are getting really smug with their propaganda and have no accountability.

Jonnax 8y ago
You seem to fundamentally misunderstand what the EU does. Each country funds the EU, it creates laws and also has programmes across the member countries. Each country elects Members of the European Parliament. No country in the EU is a direct democracy where the public vote on every decision. They elect a politician to make those decisions for them. Do you complain when your local government builds a road to someone you don't want to go?
- conanthe 8y ago
  MEPs don't create laws. They make part of the deception. The body that shapes the EU and decides nonsense like this is unelected.

justinclift 8y ago

This all sounds good, with the exception of FileZilla, who (still) distribute malware ("bundled ad offers") with their default Windows downloads. :( Seems kind of bizarre the EU would encourage such practises.

cyphar 8y ago
I think it's a stretch to say that the EU is "encouraging" such scummy practices. It's likely that they just collated a list of all software used widely by government departments within the EU -- and thus FileZilla is on the list. Ultimately, a potential 0day causing RCE within a government department is more of a concern to the EU than the optional malware you get during FileZilla's installation.
- justinclift 8y ago
  > the optional malware you get during FileZilla's installation. Think that through. The malware that comes with FileZilla is often reported to be pretty bad. Agreed, potential a 0 day (especially when targeted) could also have a really bad effect. But Filezilla's malware isn't theoretical, so could really be the bigger problem.
  - cyphar 8y ago
    I haven't used Filezilla in a _long_ time -- is the malware optional? I imagine that most EU governments image their machines, so they IT departments likely aren't installing the malware. And there is also the consideration that governments will continue to use Filezilla even if there isn't EU funding to make it more secure -- malware and all.
    - justinclift 8y ago
      Good points. Yeah, I'd hope it's the IT departments doing images, rather than end users being able to install things.

thorin1 8y ago

Never heard about "Digital Signature Services (DSS), FLUX TL, midPoint, WSO2". Why were they chosen?

BucketSort 8y ago
As others have said, they are most likely being used by the EU in some parts of their infrastructure. Then the question becomes "Why were they using these software in their infrastructure?" The answer to that is probably along the lines of "a guy that was assigned to project used it because it came up in google," if I were to hazard a guess.
- pergadad 8y ago
  Isn't this how most software is chosen? Someone finds it, realises it's useful, recommends it further, ... And down the line it's an essential tool.
kozziollek 8y ago
DSS is EU-owned library I believe. I used it instead reimplementing digital signature verification for XMLs, PDFs, hadling certificate revocation, etc. Makes sense that they want to secure own library that secures many other applications. WSO2 is Enterprise Service Bus that I used at another company (owned by government BTW) instead of one from whoever-makes-commercial-ESBs.
- cs747 8y ago
  WSO2 is more than just Enterprise Service Bus. There are a bunch of products and solutions belongs to WSO2[1]. Enterprise Service Bus, API Gateway, Identity and Acess Manager, Analytics and Stream Processing Server are the core products. [1] https://wso2.com/platform https://wso2.com/platform

pacifika 8y ago

https://etendering.ted.europa.eu/cft/cft-display.html?cftId=3375 https://etendering.ted.europa.eu/cft/cft-display.html?cftId=... I process was open tender from which the software projects were chosen.

talltimtom 8y ago

So now the game for developers is to include intentional but sufficiently abscure bugs that they can harvest money off down the line.

trulyrandom 8y ago
I don't think developers would be eligible for bounties for vulnerabilities found in their own projects.
- Ace17 8y ago
  Probably not. However, such a limitation is rather easy to workaround. Which means now, buggy commits are going to look suspicous.
- talltimtom 8y ago
  So? You sell your exploits to another dev at a fraction of the bounty, other devs so the same for you. It’s not like that puts up any real obstacle.

alkonaut 8y ago

They should put the money towards paid maintainers instead (or also).

cannedslime 8y ago

Even as a life long EU skeptic, I'm okay with this. Im not sure about the choice of projects, but I'm sure someone had their reasons for picking the projects that I don't find particularly relevant for a public funded bug bounty. Eg. Im sure that Notepad++ has its share of bugs, but I doubt many are critical or security related.

based2 8y ago

https://media.ccc.de/v/062_Hacking_EU_funding_for_a_FOSS_project https://media.ccc.de/v/062_Hacking_EU_funding_for_a_FOSS_pro...

Proven 8y ago

They fund open source projects and now they fund bug submissions and fixes too. I'd be surprised if this bureaucrat-driven innovation doesn't result in the same people producing shitty OSS and then claiming bug bounties through their cousins in Bulgaria. The EU is ruled by a mix of quasi-capitalist thieves, and socialist morons who fancy central planning. What they're doing is not only against the spirit of OSS but an abomination of "free" (the licenses may be "free" but it's all funded through state theft and involuntary taxes!)

_pmf_ 8y ago

Targeting existing projects has the advantage of creating fewer perverse incentives. EU funds for open ended projects are notorious for being leeched.

jimnotgym 8y ago
> EU funds for open ended projects are notorious for being leeched Can you give some examples please?

rendx 8y ago

The European Commission also has additional calls out for intermediaries to re-distribute funding to open source projects (ICT24), and some of the intermediaries have their respective calls open for projects (from 5k€ to 200k€): https://www.ngi.eu/opencalls/ https://www.ngi.eu/opencalls/ https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/topic-details/ict-24-2018-2019 https://ec.europa.eu/info/funding-tenders/opportunities/port...

garfieldnate 8y ago

Wow, this is great! I wish the US did this!