12 ms·
“In a typical year the OpenSSL project receives about US $2000 in donations”
- nobodyshere 13y agoIs it so vaguely undervalued or does it just work so well that it does not need too much improvement?
- danielweber 13y ago"It works even if I don't pay for it."
- humancontact 13y agoDue to its global importance, even if its security record was impeccable there would still be a huge incentive to constantly audit and test OpenSSL. It is critical for the future of the Internet that OpenSSL (or any alternative that might show up) does not have any other Heartbleed bug.
- tptacek 13y agoA sponsored bug bounty might be just as useful as more money directly to the project (especially if Google is porting Chromium to it). The nice thing about sponsoring a bug bounty is that anybody can do it; it doesn't require coordination with the project.
- BorisMelnik 13y agoThis - something like this is not only a great idea but incentive for more developers to spot some easy fixes & promote the OpenSSL brand as well.
- danielweber 13y agoAnd cheap if no one finds anything.
- daeken 13y agoThe Internet Bug Bounty that Facebook and Microsoft are sponsoring applies to OpenSSL: https://hackerone.com/ibb https://hackerone.com/ibb
- leoc 13y agoThe prize pool could use to be a damned sight larger though. Heartbleed only qualified for a $15,000 payout: a figure ten times larger would still look a bit stingy for such a serious bug.
- nightcracker 13y agoI'm certain that certain agencies would value exclusive knowledge of this bug at millions, rather than thousands.
- leoc 13y agoCertain ... private enterprises, as well. It's very unlikely that bug bounty prizes can be made to match the kind of money you might be able to get elsewhere for a big bug; but they don't really have to.
- Dorian-Marie 13y agoI'm sure that can be crowdsourced
- leoc 13y agoYup, we're just waiting on someone to do it. It wouldn't have to be OpenSSL (or even FB or MS, the existing IBB sponsors): it could be done by anyone with enough public credibility to be trusted not to run away with the money, and the time and skills to jump through the tax/charity/crowdfunding hoops.
- astrodust 13y agoBug: OpenSSL implementation. All of it.
- rmc 13y agoAnother nice thing is you can see what the money goes on. "Where does out €5,000 donation go?" "We'll find and fix bugs in software you use."
- kenrikm 13y agoWow, I'm surprised that someone that's so crucial to the well being of so much of our internet security is funded on $2000/year in donations. I think I'm going to start donating more to stuff like this.
- jasonlotito 13y agohttps://supporters.eff.org/donate https://supporters.eff.org/donate They make it easy to setup recurring donations. I'm sure even a small amount every month makes a difference.
- windsurfer 13y agoDoes the EFF donate to OpenSSL?
- juliangoldsmith 13y agoIf they did, OpenSSL wouldn't have $2000/year in donations. Most of the EFF's donations go towards fighting cases in court, if I'm not mistaken.
- jasonlotito 13y agoDon't see how that's relevant either. OP mentioned about donating to things like OpenSSL. I was recommending one.
- kashkhan 13y agothere needs to be a user owned group that funds these critical projects in a transparent and effective way. I would sign up in a heartbeat.
- patio11 13y agoNote the almost painfully predictable response to the thread. Instead of focusing how OpenSSL can pull in, let me pick a number, $800k in revenue in the next year, they immediately zero in on $70 of Paypal fees as the organization's leading financial problem.
- bhousel 13y agoThe events of this past week make me wonder how much Heartbleed would have been worth to an entity that buys zero day exploits.
- rubiquity 13y agoAsk CloudFlare how much they paid. No, I'm not saying they buy zero day expolits to be evil, but how else did they get 12 days notice?
- mschuster91 13y agoBecause the researchers had the common sense of notifying the biggest targets in advance, I think.
- danielweber 13y agoI'll defend the researchers for trying to do a managed notification. But I wonder, did they try to reach out to the major OS vendors to see if they could get them any advance warning? Or ask OpenSSL if OpenSSL knew how to get in touch with people on the down-low?
- mschuster91 13y agoThe problem with distributions is that you, in most cases, don't know who is on the other end of the security@xxx.tld email address. Being google engineers, they should have direct contacts with Cloudflare and some other high-profile targets.
- teemo_cute 13y agoOpenSSL is like a guardian angel who's invisible to a person. The guardian angel has been helping the person all the time even though he/she doesn't know it. Then the time came that the guardian angel made a little unintentional mistake that led to large consequences. The person then starts blaming the guardian angel, forgetting all the good things the angel has done for him/her.
- sz4kerto 13y agoNo, because people are paying for it. Not directly, but through their internet contracts, banks, etc. Those people expect that their stuff is secured, they do not need to know how. My grandma probably does not even know that ESP exists in cars. However, if the ESP stops working, then she could rightfully blame the car manufacturer. Persons are not blaming OpenSSL as some imaginary entity, they blame people who are involved in making, reviewing, accepting and using OpenSSL.
- ProblemFactory 13y agoI don't think the analogy works. None of the money, and all of the blame ended up with people who make and review OpenSSL as volunteers.
- paulbaumgart 13y agoSoo, throwing a little bit of economics out there: BSD-licensed open source software is pretty much a Public Good (http://en.wikipedia.org/wiki/Public_good http://en.wikipedia.org/wiki/Public_good). There are basically two ways we've figured out how to create public goods: taxation and assurance contracts (like Kickstarter). Thoughts on the pros and cons of either approach with respect to improving information security infrastructure?
- brennen 13y agoI'd be more inclined to look to state funding for encryption-related public goods if the state wasn't demonstrably an antagonist in the realm of encryption...
- sp332 13y agoSince the NSA (and probably other government agencies) are already researching vulnerabilities, it would be nice to have them made public. We're already paying for the research, so we wouldn't really have to raise taxes.
- dmix 13y agoThey are not just researching, they are weakening security for everyone, especially domestically considering Americans dominate tech businesses. So not only are Americans paying for research that returns no economic benefit (unless NSA is sharing info with American special interests and are not just security?), they are making it nearly impossible to have full trust in the information systems the business community invests heavily in protecting. I imagine if the NSA was focused on defending businesses and not reading emails of people, they wouldn't be getting the same amount of financing. They are financed for their power to exploit people the government feels threatened by, not their ability to defend citizens from harm.
- bmelton 13y agoConsidering that the NSA has known about this bug for up to two years[1], I think it's optimistic to consider that they'd be willing to help in this regard, as they've very possibly been exploiting it for some time now. [1] - http://reason.com/24-7/2014/04/11/nsa-allegedly-knew-about-major-just-disc http://reason.com/24-7/2014/04/11/nsa-allegedly-knew-about-m...
- raverbashing 13y agoUnderfunding is not an excuse for a code that gives headaches to people, lack of testing and blind acceptance of "new features" just for the sake of it.
- liquidise 13y agoThe code is openly sourced, developed, and tested. It, like privately sourced, developed and tested code contains bugs. Since you are casting the stones, am i to assume code you have been around is free of these eventualities?
- raverbashing 13y agoWhat I'm saying is that we should be looking at (open) alternatives to OpenSSL, like GnuTLS for example. It's not about open vs closed or "all code has bugs", it's about the OpenSSL project needing to rethink their security strategy and general guidance.
- feld 13y agoGnuTLS does not use an acceptable license. Apache/BSD/MIT please. It's the only way you'll find it replacing OpenSSL everywhere.
- adrianoconnor 13y agoAll software has bugs. That's an unavoidable reality. You need to learn to deal with that fact.
- ry0ohki 13y agoDumb question perhaps, but what do they need money for? What would they use it for? It says they pay it out to team members, but if people are doing this work for the money, doesn't that defeat the point?
- sharpneli 13y agoHaving enough donations allows someone to work on this full time. People need to eat and pay rent/mortgage.
- drivingmenuts 13y agoI can easily see a scenario where the overtired guy committed a bug to OpenSSL because he was working on it in his spare time from a paying job. Many, if not most of us, do the same thing. We get home - we test out ideas, burn off steam, do thing THE RIGHT WAY instead of the way we have to do it at work, etc. Except for a lot of us, our stuff doesn't go net-wide, or is not important enough, etc. His did. I will be making a donation at some point in the future when I can afford it.
- ry0ohki 13y agoAnd he's going to quit his job with your donations now? Tired people can still commit code they don't plan on hiring all of the contributors.
- LandoCalrissian 13y agoIf they could pay one guy to manage and work on it, I'm sure that approve things.
- forgottenpass 13y agoif people are doing this work for the money, doesn't that defeat the point? What exactly do you think "the point" is. To not be compensated at all in any way for your work? I see a BSDish license as an indication someone wants their work to be available to anyone. Not a statement that the product itself must be kept purely a labor of love.
- higherpurpose 13y agoShameful that so many billion dollar corporations rely on it in such a vital way, and only so little is being donated to it. I think we need a score card for donating to open source projects, in the same way we have score cards for using green materials in devices, or using renewable energy for data centers. We should see periodic reports of how much money these companies donated to open source projects.
- adrianoconnor 13y agoIndeed, and maybe we'll see some of the big companies hire and assign people to work on it now. I hope so. It'd be good to see the code audited too, though I'm not sure how you'd go about that with a project like OpenSSL. I suspect it'd have to involved funding a PhD or two...
- btbuilder 13y agoI'm interested in how the payments by third-party companies to OpenSSL foundation for white labeled FIPS-mode OpenSSL are accounted for. Maybe it's a seperate entity?
- saurik 13y agoSo, first: I agree with patio11. But past that, this thread also bugs me because it is so ill-informed: the very first question that has to be asked is "what is the distribution of donation amounts", as the way to minimize processing fees of "we got one donor who gives almost $2k, and then a handful of people we choose not to turn away who give a few dollars each" is very different than how you handle "we have $2k donors, they all give a dollar". PayPal's micropayment fees are $0.05+5%, which is a massive difference from the default $0.30+2.9% quoted. And if you have only one really large donors, you get them to give you a check. And then you put their name somewhere. And you send them some thank you letters. And you ask for their advice on how to talk to their friends, as maybe they might also want to donate. Because patio11 is just dead-on right: it is more useful to increase the incoming money here, not avoid losing some fees :/. But again: even if we choose to nitpick fees... this conversation is still going nowhere if the distribution of donations and the process of receiving them (if you have mostly random donations, having them do bank transfers is going to massively increase the loss rate ;P) is not where the discussion started.
- funkyy 13y agoLets agree that guys behind this project are not business-wise. Thus - they are not really in place to raise money, nor manage funds properly. With such an important "service" they provide, they could easily go in to ~$1 Million a year without sweating. They should look for manager/director to manage finances and growth strategy. I bet many marketing people would LOVE to manage such a project business wise including me!
- hueving 13y ago>I bet many marketing people would LOVE to manage such a project business wise including me! I highly doubt the engineers want to be 'managed' by a marketer looking to raise money.
- vacri 13y agoAt the cutover level (around $5), the micropayment fee is $0.50, whereas the standard fee would be $0.45. It's not that massive a difference. If people are donating only one dollar, then it's a wider difference (10c vs 33c), but this level of donations is neither a serious chunk of the total pool, nor the kind of donors you want to attract. One of the donors gave $0.02 - clearly meant to be a joke or a system test, and not the kind of donor you want to court.
- jokoon 13y agoWhy not rewrite the whole thing ?
- kyberias 13y agoYeah, why not. http://www.joelonsoftware.com/articles/fog0000000069.html http://www.joelonsoftware.com/articles/fog0000000069.html
- anonbanker 13y agoWorked for Mozilla.
- twic 13y agoI am utterly baffled by the fact that people are still posting that link as if it proved anything other than the fact that Joel Spolsky has absolutely no idea what he's talking about. Or has this now become a running joke? Was the posting of that link ironic?
- tempestn 13y agoWas this comment ironic? Can you back up your claim, "Joel Spolsky has absolutely no idea what he's talking about," with some evidence?
- 13y ago
- socalnate1 13y agoI'm surprised I haven't seen anyone mention the "tragedy of the commons" economic theory yet. Though in this case it seems to be happening in reverse, rather than depleting the common resource, we are all neglecting to invest in it. http://en.wikipedia.org/wiki/Tragedy_of_the_commons http://en.wikipedia.org/wiki/Tragedy_of_the_commons
- AaronFriel 13y agoWhat other people have said in comments is completely right: OpenSSL, or maybe just this Steve Marquess guy, is missing the forest for the trees. Or in this case, the six figure donations for the pennies. OpenSSL could raise more money in a few months of pan handling in a major city than they raise in a year[1]. A student group that I will soon be President of at the University of Northern Iowa[2] received more in donations and financial support. Our student group is not the best managed, but we care a lot about large sponsors, keeping good relations with them, and making asks that matter. If someone told me that panhandlers and Midwest student organizations are out-fundraising OpenSSL, I would scoff and laugh. OpenSSL? That's mission-critical software running on nearly every PC and post-PC device in the world. You know what OpenSSL reminds me of in this respect? SQLite. SQLite charges $75,000 for consortium members[3] to have 24/7 access to phone support direct to developers, guaranteed time spent on issues that matter to them, and so on. The fact that this doesn't exist for OpenSSL is an embarrassment to project management. I made an offer in that email thread to try to raise $200,000 for OpenSSL by the end of 2014, and I'm repeating it here for visibility: If you are an employee of a corporation that wants to donate to directly support OpenSSL development by funding staff time, send me an email right now: friela@uni.edu If you are in the OpenSSL foundation, send me an email right now and I will try to solve your problem by finding a phone number at every major OpenSSL using corporation and making an ask. Want me to do that? Send me an email right now: friela@uni.edu [1] http://www.ncbi.nlm.nih.gov/pmc/articles/PMC121964/ http://www.ncbi.nlm.nih.gov/pmc/articles/PMC121964/ [2] http://www.unifreethought.com http://www.unifreethought.com [3] http://www.hwaci.com/sw/sqlite/prosupport.html http://www.hwaci.com/sw/sqlite/prosupport.html [4] https://sqlite.org/consortium.html https://sqlite.org/consortium.html
- AaronFriel 13y agoNot sure why I'm downvoted, but I'm making an explicit offer to spend volunteer time making asks to corporations to raise money for OpenSSL. I don't see too many people making similar offers, and a number of people pointing out that they have the opportunity to solve their fundraising programs through corporate sponsorship, but not a whole lot of people with the free time willing to do so. Telling an underfunded volunteer-run organization what they need to do rarely works. They're busy, they have lives, and they can't afford to make a mistake with their time which is already so acutely demanded. So I'm making an offer: I'll run the corporate sponsorship program, just give me the option to do so. I'm a student, I could spend four hours tonight calling contacts at businesses and public institutions, working my way up the ladder and making asks. Has OpenSSL ever just asked for money before? Asking for money is hard for many people, I don't know why, but I've done it before, so why not?
- Nelson69 13y agoThe donations are one aspect. I'm on the dev mailing list, been lurking for a few years, I've used openssl for various things for years and I have had an interest in when some newer TLS standards were going to be supported. It's a pure bazaar as best I can tell. It's nearly magical how releases happen. I don't know if there is a secret mailing list for the core developers or some IRC channel or something, people post patches to the list, there are some occasional questions and answers, it's insanely low volume for a project as popular as it is. Every now and again some big patches with a lot of new stuff drop. Every now and again someone ponys up some big money and FIPS certification happens. It just sort of keeps meandering a long without a a benevolent dictator.
- mercurial 13y agoMy usual suggestion would be "that's part of the infrastructure, so governments should get together and foot the bill", but this approach doesn't work for this particular use case.
- betadreamer 13y agoI'm very surprised how low the donation is. This proves that OpenSSL was maintained more from contribution / volunteer rather than professionally. No wonder why they were not the first one to find the heartbleed bug...
- dpweb 13y agoThe OpenSSL debacle exposes a real problem with Open source sw. There is massive financial incentive to break it, none to make it safe. Funding its dev does little. Fund guys to break it who will tell you how they did it.
- keithgabryelski 13y agoit's time for the community (and possible all major opensource projects) to have code review parties. 1 week before, a module is declared the subject. at the time of the party, the major owners are on the hook for function by function questions, and line by line when it merits. reddit? or even a special github community service.
- dalek2point3 13y agothis might not necessarily be a good thing. see: http://en.wikipedia.org/wiki/Motivation_crowding_theory http://en.wikipedia.org/wiki/Motivation_crowding_theory
- lazylizard 13y agoi think, generally, the tendency to think openssl needs help right after seeing openssl need help is..ignoring the problem that there might be other projects similiar to openssl, who need help. its like donating to 1 disaster victim because she appeared in a news story. this thing should be left alone and looked into after a few months(i dont know how long it takes for people to forget,actually) of no stories in the press about openssl. otoh, if there were a foundation that collected money and funded many projects..it'd look like apache perhaps.. personally, i wouldn't mind an option to donate to apache or openssl in a humblebundle, nor do i mind an option to stick a donate button/widget on my website.. or even better, have the widget rotate recipients..
- wnoise 13y agoThat's unfortunately still too much. Raising any more money will only delay the death of a project that has suppressed the use of better written projects by dominating that niche in the ecosystem due to first-mover advantage.