3 ms·
I would pay more than my yearly salary to find out if I have a 'curable' cancer, so that I could treat it. To not, or ignore that, would likely mean my death. I
by lolsal 5y ago
I would pay more than my yearly salary to find out if I have a 'curable' cancer, so that I could treat it. To not, or ignore that, would likely mean my death. I imagine it is similarly motivating for OSS projects.
- thaumaturgy 5y agoIt's not. OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources. Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1]. Nobody developing OSS is grateful for programs like Zerodium. [1]: https://security.stackexchange.com/questions/199480/what-does-zerodium-do-with-their-bought-exploits-and-bugs https://security.stackexchange.com/questions/199480/what-doe...
- yoz-y 5y agoOne difference is that people may have a safety net in either savings or insurances, but underfunded open source projects don’t.