3 ms·

The cash rewards always really turned me off from DJB - it sounded like borderline crackpot behavior. The fact that he actually paid it out instantly puts all

The cash rewards always really turned me off from DJB - it sounded like borderline crackpot behavior. The fact that he actually paid it out instantly puts all doubts to rest about his seriousness. I'm of course a long time fan of qmail and djbdns daemontools etc.. I understand his motivation to provide incentives for people to find bugs in his software. Question: how do you provide incentives for people to break your system and report it to you without sounding like a crackpot, other than hiring them?

cperciva 18y ago
Have a reputation. Nobody who is qualified to review djb's code is going to get him confused with a crackpot.
tptacek 18y ago
I don't think the guarantee was a win. I think most non-security people have roughly the same initial reaction as you did; it sounded silly, especially because lots of commercial enterprises have offered "security guarantees" and held "hacking contests" and weaseled at the results. I know most security people don't care about the guarantee. We try to beat up on DJB's software because it is so hard to find security flaws in it, everyone knows that, and so a finding is a major reputation win. Nobody cares about the $1000; that's significantly less than a day's bill rate for the class of researcher that is likely to find these flaws. The moral of this story is, don't bother with the guarantee: (1) You will end up being asked to pay it out, because you are not Daniel J. Bernstein, and you will not write software as solid as qmail. (2) It isn't going to impress anyone you care about. (3) It isn't going to motivate hard-core researchers.
dfranke 18y ago
Offering prize money for discovering flaws is point #13 on the crackpot index (http://math.ucr.edu/home/baez/crackpot.html http://math.ucr.edu/home/baez/crackpot.html). I've griped in the past that this criterion is too prone to false positives, citing DJB as an example.

cperciva 18y ago

Have a reputation. Nobody who is qualified to review djb's code is going to get him confused with a crackpot.

tptacek 18y ago

I don't think the guarantee was a win. I think most non-security people have roughly the same initial reaction as you did; it sounded silly, especially because lots of commercial enterprises have offered "security guarantees" and held "hacking contests" and weaseled at the results. I know most security people don't care about the guarantee. We try to beat up on DJB's software because it is so hard to find security flaws in it, everyone knows that, and so a finding is a major reputation win. Nobody cares about the $1000; that's significantly less than a day's bill rate for the class of researcher that is likely to find these flaws. The moral of this story is, don't bother with the guarantee: (1) You will end up being asked to pay it out, because you are not Daniel J. Bernstein, and you will not write software as solid as qmail. (2) It isn't going to impress anyone you care about. (3) It isn't going to motivate hard-core researchers.

dfranke 18y ago

Offering prize money for discovering flaws is point #13 on the crackpot index (http://math.ucr.edu/home/baez/crackpot.html http://math.ucr.edu/home/baez/crackpot.html). I've griped in the past that this criterion is too prone to false positives, citing DJB as an example.