4 ms·

Is there any such thing as 'bug bounties' that companies put out to get fixes for open source software?

by Tycho 5y ago

ssddanbrown 5y ago
Upon the suggestions from other commenters, I've had recent interaction with huntr.dev. I maintain an open source project and had a few members on there report vulnerabilities over the last month or two. They seem to pay out both to the finder of the vulnerability and the maintainer (me). The process seemed a janky at first but they've improved the platform since my first interaction and they seem to be encouraging a good thing. Had a few false reports but that has been outweighed by well-defined genuine reports.
maximedupre 5y ago
That a great question...never heard of it for OSS
- roflc0ptic 5y ago
  It seems like it would create some bad incentives for open source maintainers/submitters - someone submits a PR to fix a bug, gets rejected, maintainer commits a similar bug fix, claims reward. Dunno. Interesting idea, execution might have bad knock on effects
  - maximedupre 5y ago
    > It seems like it would create some bad incentives for open source maintainers/submitters - someone submits a PR to fix a bug, gets rejected, maintainer commits a similar bug fix, claims reward. Well that would never work
    - maximedupre 5y ago
      Meaning that it would be obvious what that said maintainer did to claim the reward lol
zeeg 5y ago
Usually people use that term for security concerns these days, which definitely exist for open source. I've seen stuff over the years where people have attempted to do bounties for implementing a feature/bugfix/etc, but its never really taken off.
evan_ 5y ago
BountySource: https://www.bountysource.com/ https://www.bountysource.com/ > What is Bountysource? > Bountysource is the funding platform for open-source software. Users can improve the open-source projects they love by creating/collecting bounties and pledging to fundraisers.
jacques_chester 5y ago
Yes. There's the Internet Bug Bounty[0], which is administered by HackerOne and funded by a number of companies. It's paid out three quarters of a million dollars since its foundation in 2013. It was relaunched last month. The pace is picking up, too: $100k has been paid out in the last 90 days[1]. Disclosure: I know of it because I work for Shopify, which is one of the donors. [0] https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty [1] https://hackerone.com/ibb?type=team https://hackerone.com/ibb?type=team

Is there any such thing as 'bug bounties' that companies put out to get fixes for open source software?

by Tycho 5y ago

Is there any such thing as 'bug bounties' that companies put out to get fixes for open source software?

Upon the suggestions from other commenters, I've had recent interaction with huntr.dev. I maintain an open source project and had a few members on there report vulnerabilities over the last month or two. They seem to pay out both to the finder of the vulnerability and the maintainer (me). The process seemed a janky at first but they've improved the platform since my first interaction and they seem to be encouraging a good thing. Had a few false reports but that has been outweighed by well-defined genuine reports.

maximedupre 5y ago

That a great question...never heard of it for OSS

roflc0ptic 5y ago
It seems like it would create some bad incentives for open source maintainers/submitters - someone submits a PR to fix a bug, gets rejected, maintainer commits a similar bug fix, claims reward. Dunno. Interesting idea, execution might have bad knock on effects
- maximedupre 5y ago
  > It seems like it would create some bad incentives for open source maintainers/submitters - someone submits a PR to fix a bug, gets rejected, maintainer commits a similar bug fix, claims reward. Well that would never work
  - maximedupre 5y ago
    Meaning that it would be obvious what that said maintainer did to claim the reward lol

zeeg 5y ago

Usually people use that term for security concerns these days, which definitely exist for open source. I've seen stuff over the years where people have attempted to do bounties for implementing a feature/bugfix/etc, but its never really taken off.

evan_ 5y ago

BountySource: https://www.bountysource.com/ https://www.bountysource.com/ > What is Bountysource? > Bountysource is the funding platform for open-source software. Users can improve the open-source projects they love by creating/collecting bounties and pledging to fundraisers.

jacques_chester 5y ago

Yes. There's the Internet Bug Bounty[0], which is administered by HackerOne and funded by a number of companies. It's paid out three quarters of a million dollars since its foundation in 2013. It was relaunched last month. The pace is picking up, too: $100k has been paid out in the last 90 days[1]. Disclosure: I know of it because I work for Shopify, which is one of the donors. [0] https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty [1] https://hackerone.com/ibb?type=team https://hackerone.com/ibb?type=team