3 ms·

There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a worl

by e40 5y ago

There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs. And open source projects likely pay nothing! I've certainly never heard of a paid bug bounty for any open source project, which doesn't mean they don't exist, it just means it's not that common.

SEJeff 5y ago
There definitely are a few, kubernetes actually has a dedicated one that hacker one runs. Here are a few examples: https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty https://huntr.dev/ https://huntr.dev/ https://securitylab.github.com/bounties/ https://securitylab.github.com/bounties/ https://www.mozilla.org/en-US/security/bug-bounty/ https://www.mozilla.org/en-US/security/bug-bounty/
mikeodds 5y ago
There are some but for of the projects I’ve looked at, you are almost certainly getting a better payout by selling the vulnerability (monetarily not karma wise) to zerodium et al.
- deleted 5y ago
  [deleted]