5 ms·
I don't think cognitive dissonance is the right label to apply to this. I read it more as a misalignment of incentives. It's a sad comment on the state of thing
by thaumaturgy 5y ago
I don't think cognitive dissonance is the right label to apply to this. I read it more as a misalignment of incentives. It's a sad comment on the state of things that a year of effort to produce some popular software is worth only a quarter of what somebody else is willing to pay for exploitable bugs in that same software.
Like, I understand why that's the case, but it still sucks.
- ianai 5y agoUnless the foss developer is also getting the RCE award.
- mcguire 5y agoThat would be a conflict of interest, no?
- lolsal 5y agoI would pay more than my yearly salary to find out if I have a 'curable' cancer, so that I could treat it. To not, or ignore that, would likely mean my death. I imagine it is similarly motivating for OSS projects.
- thaumaturgy 5y agoIt's not. OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources. Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1]. Nobody developing OSS is grateful for programs like Zerodium. [1]: https://security.stackexchange.com/questions/199480/what-does-zerodium-do-with-their-bought-exploits-and-bugs https://security.stackexchange.com/questions/199480/what-doe...
- yoz-y 5y agoOne difference is that people may have a safety net in either savings or insurances, but underfunded open source projects don’t.