Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Mozilla Bug Security The Almighty Buck Technology

Mozilla Bumps Security Bug Bounty To $3,000 73

Posted by kdawson from the doing-well-by-doing-good dept.
Trailrunner7 writes "In an effort to enlist more help finding bugs in its most popular software — Firefox, Thunderbird, and Firefox Mobile — Mozilla is jacking up the bounty it pays to researchers who report security flaws to $3,000. 'For new bugs reported starting July 1st, 2010 UTC we are changing the bounty payment to $3,000 US per eligible security bug. A lot has changed in the 6 years since the Mozilla program was announced, and we believe that one of the best ways to keep our users safe is to make it economically sustainable for security researchers to do the right thing when disclosing information,' said Lucas Adamski, director of security engineering at Mozilla. In addition to Mozilla, Google also has established a bug bounty program — though at $500 it has been called 'insulting.' None of the larger software vendors such as Microsoft or Oracle have taken that step. Some researchers see that as inevitable, however."
This discussion has been archived. No new comments can be posted.

Mozilla Bumps Security Bug Bounty To $3,000 More

Mozilla Bumps Security Bug Bounty To $3,000

Comments Filter:

  • Insulting? (Score:4, Insightful)

    by CannonballHead ( 842625 ) on Friday July 16, 2010 @11:01AM (#32927194)

    Why is it insulting? Maybe it's "too little" but getting money for what most companies don't pay for is insulting?

    Are people really that stuck up? hehe.

    • Re: (Score:3, Funny)

      by sakdoctor ( 1087155 )

      I take all pricing set above or below the true market value to be a PERSONAL insult!
      You insensitive clod.

      • Pricing ABOVE true market value is a personal insult, too? Yikes. ;)

      • But $500 was the market value. That was the most that the Moz foundation was willing to pay for sec bugs.

        They got a bunch of the low hanging fruit with that.

        Now at $3k they'll get the next harder sec bugs reported and fixed, as well as paying out some more money for fewer bugs.

        At some point I bet they'll raise it again to maybe $10k, $20k, $100k as they find and nail down all security problems. Wasn't Tex or LaTex or something done in a similar way as well?

        • I admit I don't know much about it, but I don't get the impression that TeX support as much of a moving target as Web browser security/UI/standards/etc. What massive changes has LaTeX needed to undergo these last few years in order to stay relevant? Mozilla has improved their Acid3 support, deal with security vulnerabilities that will never apply to LaTeX, added Theora support for the <video> tag, they're probably working on the rest of HTML5, they're changing to a Chrome-like UI, they're overhauling

        • You're probably thinking of these [wikipedia.org]. Not quite $3000, but 0x$1 is a start.

    • Re:Insulting? (Score:4, Insightful)

      by AHuxley ( 892839 ) on Friday July 16, 2010 @11:08AM (#32927304) Journal
      Yes for what most post to blogs, forums, mailing lists ect for free its a fair amount esp for any student.
      • Precisely. $3000 is of course more than $500, and Google certainly could afford more ... although, on the other hand, Google has way more products to find bugs in, etc. Anyways, the whiff of "entitlement" in that statement seems strong to me.

        • Re:Insulting? (Score:4, Informative)

          by Lunix Nutcase ( 1092239 ) on Friday July 16, 2010 @11:22AM (#32927518)

          What entitlement? Finding these major exploits are not easy and can easily take weeks or months or work to uncover. To think that $500 is a sufficient payment to recompense them for their work is a joke. Especially when they can get anywhere from 10 to 100 times that by selling these exploits to the black market.

      • Re:Insulting? (Score:4, Insightful)

        by Lunix Nutcase ( 1092239 ) on Friday July 16, 2010 @11:12AM (#32927368)

        Except that the people who will mostly be discovering these bugs and exploits are not students. They are going to be professionals that can get upwards of $10,000+ depending on the severity of the exploit they find.

        • meh, I'm student and a comp sci grad and I almost certainly won't find anything but that figures enough that I'll be spending a few evenings this week examining the firefox source code.

          • Re:Insulting? (Score:4, Insightful)

            by Lunix Nutcase ( 1092239 ) on Friday July 16, 2010 @11:24AM (#32927544)

            These researchers don't find the exploits and bugs by reading the source code. They do it by fudging around with the binary while the program is running.

            • Do you mean besides Charlie Miller frequent pwn2own winner? [tomshardware.com] He uses fuzzers and source code, and even reverse engineers binaries.

              • Re: (Score:3, Funny)

                by Lunix Nutcase ( 1092239 )

                He may use source code if it's available, which it isn't for IE which has has found exploits in, once he's found something by after doing the fuzzing but I can assure you he doesn't just stare at the source code and go "AHA! A BUFFER OVERFLOW!!".

            • If the source is available, they'll also read through it. It's quite possible that they'll notice something someone else didn't especially if 1) they didn't write the code and 2) they know the kinds of things they are looking for. When code is not available a common step is to disassemble the code and to start to reverse engineer it.

              Automatic fuzzers and exploit testers seldom provide results as 1) vendors can and generally do run such tests themselves and 2) they only test for the particular cases they are

        • Re: (Score:2)

          by n6mod ( 17734 )

          But to make tens of thousands on the black market, you really need a weaponized exploit. Mozilla will be quite happy with a detailed bug report.

          • Re: (Score:3, Informative)

            by gumbi west ( 610122 )

            No, Charlie Miller talks about much larger payouts from MS. He said, "I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I’ve talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I’d say $50,000 is a low-end price point." here [zdnet.com].

          • No, someone else can weaponise it easily, have you seen the way metasploit works? It takes little common exploit and common payload and sticks them together into one weaponised exploit.

        • while you can make an argument that you are technically correct, "upwards of $10,000" is pretty misleading, "less than $5000" would be a better figure.

          Trailrunner7 writes "Despite all of the hand-wringing and moral posturing about the public sale of security vulnerabilities, it turns out that not many people are buying or selling vulns, and the ones who are aren't making much money at it. A new survey of security researchers who sell vulnerabilities either publicly or in private, directed sales found that

    • I think "insulting" is code for "the market value of this vulnerability is much higher. I'd rather sell it to buyer other than Mozilla." In other words, most ethics are based in economics. Its easy to do good when there's money involved in doing so.

      • No, I think the $500 offered by google is insulting because it's like offering some $10 to clean your house when it would cost them more than that to drive there. Interestingly, people don't seem to mind that much when the price is like $1 million, i.e. DARPA has given prizes of this size and the winner has spent six times that (not to mention all the looser) but I think if DARPA didn't want to offer the $1 million, they would be better off offering nothing than, i.e. $50, because the nothing suggests that

    • Re: (Score:2, Insightful)

      by alexmipego ( 903944 )

      If you work on something you usually like to get paid. It's considered insulting to pay just 500$ for a bug simply because you can get a much higher paycheck if you sell it on the black market. So, if you're into security research to make money, 500$ is an insult to people's time.

      • It's considered insulting to pay just 500$ for a bug

        Donald Knuth used to pay $2.56 per bug found in his programming books, the recognition was more valuable than the amount and most people would frame the checks and never cash, as a matter of pride "I was recognized."
        So getting a acknowledgment of finding a bug +value, getting significant money as well ++ value. Not worrying about selling your bug to people who might kill you if they think you screwed them or turned them in, and not worrying if the FBI, etc will throw you in jail for breaking laws... pric

        • Finding a bug in a book is a matter of reading, proof reading and testing every example on the book to see if it works well. You could say it's an exact science because you can simply define a couple rules and follow them until you find a small mistake.

          Finding a bug on a software isn't that simple. For starters there are millions of lines of code and unlike books a single line can affect millions of other line's logic paths/assumptions/etc. There is no single method you can apply to find a bug and that's wh

          • Finding a bug on a software isn't that simple. For starters there are millions of lines of code

            That is likely true for fixing a bug. No where did it say you had to find the line of code, that causes the issue. But finding a bug in software, when you have the software, and say it was free software so anyone could use it... Then the difficulty in finding a bug could be as simple as downloading a copy of Mozilla and using it.
            Similar to this security issue bounty, his bounty wasn't for grammer, it was for finding a significant issue. Most likely this $500 gives enough incentive to pay for the time sp

            • That's true if you're the casual finder, but not if you live of security research.

              I do know it isn't as simple as looking at the code and sometimes you don't even do that, the point was that finding a bug on something as widely tested and used and a browser isn't as simple as proof-reading a book.

          • So the solution is to write a book about Firefox?

        • Re: (Score:3, Informative)

          by quickOnTheUptake ( 1450889 )
          There is a big difference between a personal check from a legend and a check from a foundation or company. I would frame a check from Knuth; I would cash a check from Mozilla.

        • Re: (Score:1)

          by mots ( 1192769 )
          Similarly, google pays $1337 for particularly severe or particularly clever bugs.
        • He still does, (figuratively, anyway, it's now a hall of fame on his website). He did it for TeX too, the key is his pricing scheme with TeX was such that the next bug would be exponentially more expensive, as that way as there were less bugs left to find so he payed more for finding them. However as TeX is now in several different implementations that aren't maintained by Knuth, he nolonger needs to worry about the TeX ones.

    • Re: (Score:2)

      by Goaway ( 82658 )

      The companies may not pay for it, but that does not mean there are not others who will pay.

  • Many eyes make all bugs shallow...not (Score:1, Funny)

    by Anonymous Coward

    <nt>

  • It worked for him; the cheque from him was worth far more than the value printed on it. I think that offering rewards for disclosure can only lead to better code. Microsoft hasn't yet implemented this method as they would rapidly go broke.

  • As an example, text box input of Firefox used to have some bad bugs I never did track down, though I tried. After much editing and jumping about in the text box, sometimes using backspace would erase the wrong character. Would remove a character at the end of a line several lines above the cursor. Tried to recreate the bug with sequences of keystrokes I guessed might cause it, but no luck. I thought of buying a keylogger so I could capture the keystrokes the next time it happened. But that was getting t

  • "It's not a bug, it's a feature!"

  • Bad Idea (Score:3, Informative)

    by slasho81 ( 455509 ) on Friday July 16, 2010 @12:02PM (#32928126)
    Giving money for finding bugs is counterproductive. Here's why: http://www.youtube.com/watch?v=AIqtbPKjf6Q [youtube.com]
    • That video explains why giving a low amount such as $500 is counterproductive. Paying a fair amount of money for security research is compensating people for the time and effort for finding and reporting the bug. As an example from the video, it's like giving someone $50, a fair amount, to change your tire instead of $1, which is an insulting amount.
      • You completely missed the point. It's about the social contract.
        • We don't have a social contract with Mozilla. It's a corporation. Do you build a social relationship with Mozilla so it can help you in times of distress? It sounds like you missed the point.

          • Re: (Score:2)

            by dveditz ( 11090 )

            A public benefit corporation wholly owned by a non-profit foundation. If you don't think this approach furthers the mission please let us know.

            • I think it does further the mission. Giving $3000 per security bug is not counterproductive because security researchers do not have a social contract with Mozilla. Mozilla will not give us a ride to work if our car breaks down. Mozilla giving $3000 for a security bug is not like giving your mother-in-law money for Thanksgiving dinner for this reason.

    • Re: (Score:1)

      by TravisO ( 979545 )
      Dan is talking about paying money as a routine, like a salary. The security exploit pay is like a reward, you don't get paid for the effort, anybody can make the effort but only 1% of the people who would try are capable of finding a real security hole. The effect doesn't apply.

    • Re: (Score:1)

      by sunwolf ( 853208 )
      ....aaaaand more: http://www.youtube.com/watch?v=u6XAPnuFjJc [youtube.com]

      • I don't see how that applies in this situation, either. Mozilla is not paying people to specifically look for security problems in Firefox. The security researchers do whatever they want -- they're autonomous, doing the research they want to do for their own motivation. If during their work they happen to find a bug in Mozilla, this makes it easy for them to do the right thing and report the problem to Mozilla first, before someone else finds the problem.

        According to the video, if they employed security res

    • Re: (Score:2)

      by BZ ( 40346 )

      This isn't money for finding bugs. This is money for, once you have found a bug, reporting it to Mozilla as opposed to selling it on the black market or just posting it on your blog so as to 0-day users.

      That is, the assumption is that people are looking for bugs and are perhaps finding them. The bounty is to convince them to do things _after_ that in a way that does minimal harm to Mozilla's user.

  • Comment removed based on user account deletion
  • I need to sign up to work on Mozilla products! Boss: "Our goal is to write bug free software. I'll pay a ten-dollar bonus for every bug you find and fix. I hope this drives the right behavior." Wally: "I'm gonna write me a new minivan this afternoon!"

    • Re: (Score:3, Informative)

      by bunratty ( 545641 )
      This is the exact reason for the disqualification criterion for the bug bounty [mozilla.com]

      In concert with those changes, we are also updating the eligibility language to make it clear that Mozilla reserves the right to disqualify bugs from the bounty payment if the reporter has been deemed to have acted against the best interests of our users.

  • Is what it would take to get me to look at it.
  • Microsoft would never do this they would get hackered apart worse then they do now with virus and spyware problems. There PR department would be out of control busy. Plus Microsoft patch team would have to be doubled in staff. Patch Tuesday would be every Tuesday.

  • Just curious, but who is donating bucks to Mozilla?

Slashdot Top Deals

"Poor man... he was like an employee to me." -- The police commisioner on "Sledge Hammer" laments the death of his bodyguard

Close