5 ms·

>(not that I know anything about crypto) Me either, and while I chuckled, I think cperciva is one of the better qualified people to be implementing crypto.

djcapelis 16y ago
No one is qualified to implement crypto without review. cperciva is extremely qualified to implement crypto, but not without review. I think it is wise that he has implemented a bug bounty procedure. He should make sure it applies to unreleased versions too so maybe someone will put an RSS feed of his SCM checkins into their RSS reader and try and catch bugs as he's making them. :) It would be nice if he had the money to spring for paying someone else to look at all his changes, but alas... that stuff is expensive!
- tptacek 16y ago
  Bug bounties are not reviews. No professional is going to undertake a review on spec. The demand for software security is too high; most of us have our pick of interesting projects that will pay whether we find something or not. We're not unique in that respect; top iPhone developers won't work for you on spec either, not because spec is evil, but because the economics don't work. Furthermore, you can pay $1000 for XSS bugs and random memory corruption flaws in browsers because fuzzers can find them, because they're luck-of-the-draw findings, and because people are hammering those things whether you pay them or not. But $1000 doesn't pay for a day of qualified review, and no qualified reviewer would suggest less than two weeks for something like Tarsnap.
  - djcapelis 16y ago
    I agree on all of this. However, since Colin presumably doesn't want to raise his prices to pay for actual review, it is encouraging that he is at least going with bug bounties. These, at the very least, gives us a good excuse to assign them as fun things to do for graduate students with some hope that one will want to procrastinate so hard that they will actually look at the code. Also I think any reviewer who wanted to get paid would not start with Colin's code as an easy place to find bugs.
    - cperciva 16y ago
      This is one reason why I'm going to be providing bounties for more than just security bugs. Even if people don't expect to find security bugs, they might find a typo in a comment and earn themselves a $1 tarsnap account credit -- and as demonstrated here, simply looking at source code can result in finding bugs even if you weren't originally looking for them.
      - djcapelis 16y ago
        Clever. Especially since "normal" bugs occasionally have that nasty habit of turning into security relevant bugs. It will be interesting to see how close you can manage to get something resembling good review on a budget. Hopefully other people who are in similar low margin code businesses will keep an eye on your experiment to see how it works out. Thanks for being so open about how you're trying to make things work. I hope you'll be publishing all the awarded bounties? (I suppose I should just wait for your follow-up entry.)
        cperciva 16y ago
        Yes, I'll find somewhere on the website to put that list.
      - jacquesm 16y ago
        Finding a bug in tarsnap is something that might be worth considerably more than your bounty to the highest bidder.
        cperciva 16y ago
        Quite likely. But fortunately for me, most people get nervous at the idea of negotiating with organized crime syndicates.
        bmastenbrook 16y ago
        Not that I've seen, but I might have a different view of what constitutes an organized crime syndicate than you do.
  - deleted 16y ago
    [deleted]

djcapelis 16y ago

No one is qualified to implement crypto without review. cperciva is extremely qualified to implement crypto, but not without review. I think it is wise that he has implemented a bug bounty procedure. He should make sure it applies to unreleased versions too so maybe someone will put an RSS feed of his SCM checkins into their RSS reader and try and catch bugs as he's making them. :) It would be nice if he had the money to spring for paying someone else to look at all his changes, but alas... that stuff is expensive!

tptacek 16y ago
Bug bounties are not reviews. No professional is going to undertake a review on spec. The demand for software security is too high; most of us have our pick of interesting projects that will pay whether we find something or not. We're not unique in that respect; top iPhone developers won't work for you on spec either, not because spec is evil, but because the economics don't work. Furthermore, you can pay $1000 for XSS bugs and random memory corruption flaws in browsers because fuzzers can find them, because they're luck-of-the-draw findings, and because people are hammering those things whether you pay them or not. But $1000 doesn't pay for a day of qualified review, and no qualified reviewer would suggest less than two weeks for something like Tarsnap.
- djcapelis 16y ago
  I agree on all of this. However, since Colin presumably doesn't want to raise his prices to pay for actual review, it is encouraging that he is at least going with bug bounties. These, at the very least, gives us a good excuse to assign them as fun things to do for graduate students with some hope that one will want to procrastinate so hard that they will actually look at the code. Also I think any reviewer who wanted to get paid would not start with Colin's code as an easy place to find bugs.
  - cperciva 16y ago
    This is one reason why I'm going to be providing bounties for more than just security bugs. Even if people don't expect to find security bugs, they might find a typo in a comment and earn themselves a $1 tarsnap account credit -- and as demonstrated here, simply looking at source code can result in finding bugs even if you weren't originally looking for them.
    - djcapelis 16y ago
      Clever. Especially since "normal" bugs occasionally have that nasty habit of turning into security relevant bugs. It will be interesting to see how close you can manage to get something resembling good review on a budget. Hopefully other people who are in similar low margin code businesses will keep an eye on your experiment to see how it works out. Thanks for being so open about how you're trying to make things work. I hope you'll be publishing all the awarded bounties? (I suppose I should just wait for your follow-up entry.)
      - cperciva 16y ago
        Yes, I'll find somewhere on the website to put that list.
    - jacquesm 16y ago
      Finding a bug in tarsnap is something that might be worth considerably more than your bounty to the highest bidder.
      - cperciva 16y ago
        Quite likely. But fortunately for me, most people get nervous at the idea of negotiating with organized crime syndicates.
        bmastenbrook 16y ago
        Not that I've seen, but I might have a different view of what constitutes an organized crime syndicate than you do.
- deleted 16y ago
  [deleted]