7 ms·

Should gov.uk run a bug bounty?

19 points by edent 13y ago

csmithuk 13y ago
No. They shouldn't. They are publicly funded so efficiency of cash flow is important. No reward should be required in this circumstance apart from perhaps an acknowledgement. They should operate an open submission policy though i.e. a bug report form and actually feed back to people.
- aaronem 13y ago
  I can think of a purely utilitarian reason to offer a bug bounty: Getting paid a bounty directly by the government is easier and safer than selling an exploit to someone who will use it for criminal purposes. Granted that in an ideal world this sort of incentive wouldn't be necessary, but if we lived in an ideal world, code wouldn't have bugs in it, too. And another reason: If the government pays bounties for confirmed bug reports, a prospective reporter can have some confidence that they won't react to the report by taking punitive action, which might otherwise be a very real concern; HN periodically sees threads about employers and clients reacting extremely badly to unsolicited exploit reports, and the worst those can do stops short of imprisoning somebody. Of course, all of this assumes a government not so sclerotic that it'll take an interest in fixing bugs without first having to be motivated by a horribly embarrassing public compromise, which means it's probably not going to work in the UK, or for that matter in the US either. But it's a nice thought, I suppose.
  - yerma 13y ago
    But in offering a bug bounty you will effectively give the okay for anyone anywhere to attack your assets. This would remove the ability to detect or easily prosecute attackers as up to a point the bounty hunters and bad guys will look exactly the same.
- shawabawa3 13y ago
  > They are publicly funded so efficiency of cash flow is important Bug bounty rewards are orders of magnitude cheaper than the damage the bugs can cause. If they have a bug report form at all and employ people to screen and respond to bug reports, the bounty costs probably wont even add up to the cost of 1 additional employee
  - csmithuk 13y ago
    Depends. In the UK we just wait for the minister in charge to resign. That's cheaper than a bug bounty :)
  - yerma 13y ago
    I disagree, when you understand the way UK government works, any compromises will be cheaper in nearly every case along with requiring no action on their part in the first place which is even better. Planning the creation of a team to handle this will likely run in to the millions before you've even begun, that is the way it works. And noone resigns they just go in to hiding for a while ;)
- room271 13y ago
  Do you think that private companies that use bug bounties are being inefficient then?
  - csmithuk 13y ago
    Probably but that's moot. They're pissing away profit and investor's cash in private companies. In public organisations, taxpayers don't get to choose if that money is spent or not.
JamesBaxter 13y ago
Maybe there should be a public record of the bugs and who found them, something you could point to on a CV.
- edent 13y ago
  That could be a very interesting idea. I know Google run a Hall of Fame, and Facebook do something similar.
mattmanser 13y ago
I think it's impressive how far they've come the last few years. Props to the gov.uk team if any of them lurk here, they even came and commented when the initial designs were posted here: https://news.ycombinator.com/item?id=3811052 https://news.ycombinator.com/item?id=3811052 Yes, the probably eventually should, but given how we've gone from terrible websites by contractors to decent ones in a short time, I'm not going to start jumping up and down about it yet. Although if they could get round to redesigning the 'gateway' crap sooner rather than later it'd be much appreciated. I have already been given 25 different gateway IDs.
- csmithuk 13y ago
  I am and I'm not impressed. Whilst the outcome is positive, the technology churn isn't. In fact, it's a right mess. They've ended up with a huge stack that doesn't need to be there. They're there to provide content efficiently, not redesign the infrastructure. They're using tech because it's cool and fun rather than suitable for the task and cost effective. I know people are going to compare them to EDS and say "look how far we've come" etc but they are still spending public money and are not beyond scrutiny from us tax payers. They're not a startup either. The ground they're standing on is different to what they think they're standing on. Edit: downvoters, please at least have the honour to explain yourselves.
  - ronaldx 13y ago
    Having a central body which sets government digital policy on how to provide information across departments is great. That they're doing a fantastic job of providing content to users efficiently, using appropriate technology and without favouring commercial solutions, is incredible. Compare the clusterfuck that is http://www.cyberstreetwise.com http://www.cyberstreetwise.com. Contracted-out websites cannot match the quality and cost effectiveness. I downvoted you because it's really very difficult to understand what you are actually complaining about: you are trolling.
    - csmithuk 13y ago
      I'm not trolling. I've watched them build their own stack, throw it away, build it again, throw it away. That's waste.
jpswade 13y ago
If bugs are an issue, why not get started and fix them? * https://github.com/alphagov/ https://github.com/alphagov/ * http://alphagov.github.io/ http://alphagov.github.io/ * https://gds.blog.gov.uk/2012/10/12/coding-in-the-open/ https://gds.blog.gov.uk/2012/10/12/coding-in-the-open/ Looks great on your CV, you're helping your government do it right, everyone's a winner.
- edent 13y ago
  I'm not specifically talking about https://gov.uk/ https://gov.uk/ but rather all of X.gov.uk - like HMRC, DWP, etc. That said, is there a way on GitHub to privately raise a security related issue without the whole world seeing it?
  - matthewcford 13y ago
    Not that I'm aware, they should probably have a disclosure email address/policy
  - staticshock 13y ago
    Not for a public project... And github got rid of their private messaging system, suggesting that people email the package maintainers instead. So, the preferred route would probably be to do that. gov.uk could have an email address that functions as the front end to a private bug tracker.
  - jpswade 13y ago
    Many of them are now open source too: * http://government.github.com/community/ http://government.github.com/community/ For example: * https://github.com/hmrc https://github.com/hmrc Sure it's not everything yet, but it's progress. You can still reach the right people and get involved.
Nursie 13y ago
I'm still waiting for a response on what sort of privacy analysis took place when they decided to use Google Analytics to track and analyse UK citizens interactions with UK government. It still doesn't smell right.

19 points by edent 13y ago

No. They shouldn't. They are publicly funded so efficiency of cash flow is important. No reward should be required in this circumstance apart from perhaps an acknowledgement. They should operate an open submission policy though i.e. a bug report form and actually feed back to people.

aaronem 13y ago
I can think of a purely utilitarian reason to offer a bug bounty: Getting paid a bounty directly by the government is easier and safer than selling an exploit to someone who will use it for criminal purposes. Granted that in an ideal world this sort of incentive wouldn't be necessary, but if we lived in an ideal world, code wouldn't have bugs in it, too. And another reason: If the government pays bounties for confirmed bug reports, a prospective reporter can have some confidence that they won't react to the report by taking punitive action, which might otherwise be a very real concern; HN periodically sees threads about employers and clients reacting extremely badly to unsolicited exploit reports, and the worst those can do stops short of imprisoning somebody. Of course, all of this assumes a government not so sclerotic that it'll take an interest in fixing bugs without first having to be motivated by a horribly embarrassing public compromise, which means it's probably not going to work in the UK, or for that matter in the US either. But it's a nice thought, I suppose.
- yerma 13y ago
  But in offering a bug bounty you will effectively give the okay for anyone anywhere to attack your assets. This would remove the ability to detect or easily prosecute attackers as up to a point the bounty hunters and bad guys will look exactly the same.
shawabawa3 13y ago
> They are publicly funded so efficiency of cash flow is important Bug bounty rewards are orders of magnitude cheaper than the damage the bugs can cause. If they have a bug report form at all and employ people to screen and respond to bug reports, the bounty costs probably wont even add up to the cost of 1 additional employee
- csmithuk 13y ago
  Depends. In the UK we just wait for the minister in charge to resign. That's cheaper than a bug bounty :)
- yerma 13y ago
  I disagree, when you understand the way UK government works, any compromises will be cheaper in nearly every case along with requiring no action on their part in the first place which is even better. Planning the creation of a team to handle this will likely run in to the millions before you've even begun, that is the way it works. And noone resigns they just go in to hiding for a while ;)
room271 13y ago
Do you think that private companies that use bug bounties are being inefficient then?
- csmithuk 13y ago
  Probably but that's moot. They're pissing away profit and investor's cash in private companies. In public organisations, taxpayers don't get to choose if that money is spent or not.

JamesBaxter 13y ago

Maybe there should be a public record of the bugs and who found them, something you could point to on a CV.

edent 13y ago
That could be a very interesting idea. I know Google run a Hall of Fame, and Facebook do something similar.

mattmanser 13y ago

I think it's impressive how far they've come the last few years. Props to the gov.uk team if any of them lurk here, they even came and commented when the initial designs were posted here: https://news.ycombinator.com/item?id=3811052 https://news.ycombinator.com/item?id=3811052 Yes, the probably eventually should, but given how we've gone from terrible websites by contractors to decent ones in a short time, I'm not going to start jumping up and down about it yet. Although if they could get round to redesigning the 'gateway' crap sooner rather than later it'd be much appreciated. I have already been given 25 different gateway IDs.

csmithuk 13y ago
I am and I'm not impressed. Whilst the outcome is positive, the technology churn isn't. In fact, it's a right mess. They've ended up with a huge stack that doesn't need to be there. They're there to provide content efficiently, not redesign the infrastructure. They're using tech because it's cool and fun rather than suitable for the task and cost effective. I know people are going to compare them to EDS and say "look how far we've come" etc but they are still spending public money and are not beyond scrutiny from us tax payers. They're not a startup either. The ground they're standing on is different to what they think they're standing on. Edit: downvoters, please at least have the honour to explain yourselves.
- ronaldx 13y ago
  Having a central body which sets government digital policy on how to provide information across departments is great. That they're doing a fantastic job of providing content to users efficiently, using appropriate technology and without favouring commercial solutions, is incredible. Compare the clusterfuck that is http://www.cyberstreetwise.com http://www.cyberstreetwise.com. Contracted-out websites cannot match the quality and cost effectiveness. I downvoted you because it's really very difficult to understand what you are actually complaining about: you are trolling.
  - csmithuk 13y ago
    I'm not trolling. I've watched them build their own stack, throw it away, build it again, throw it away. That's waste.

jpswade 13y ago

If bugs are an issue, why not get started and fix them? * https://github.com/alphagov/ https://github.com/alphagov/ * http://alphagov.github.io/ http://alphagov.github.io/ * https://gds.blog.gov.uk/2012/10/12/coding-in-the-open/ https://gds.blog.gov.uk/2012/10/12/coding-in-the-open/ Looks great on your CV, you're helping your government do it right, everyone's a winner.

edent 13y ago
I'm not specifically talking about https://gov.uk/ https://gov.uk/ but rather all of X.gov.uk - like HMRC, DWP, etc. That said, is there a way on GitHub to privately raise a security related issue without the whole world seeing it?
- matthewcford 13y ago
  Not that I'm aware, they should probably have a disclosure email address/policy
- staticshock 13y ago
  Not for a public project... And github got rid of their private messaging system, suggesting that people email the package maintainers instead. So, the preferred route would probably be to do that. gov.uk could have an email address that functions as the front end to a private bug tracker.
- jpswade 13y ago
  Many of them are now open source too: * http://government.github.com/community/ http://government.github.com/community/ For example: * https://github.com/hmrc https://github.com/hmrc Sure it's not everything yet, but it's progress. You can still reach the right people and get involved.

Nursie 13y ago

I'm still waiting for a response on what sort of privacy analysis took place when they decided to use Google Analytics to track and analyse UK citizens interactions with UK government. It still doesn't smell right.