Hacker News Reader

Comment by tiffanyh | Hacker News Reader

I wonder what impact this will have on open source software (OSS).

OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can.

I wonder if there will exist a date/time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.

View on HN

Similar behaviors likely exists in OSS they are just called different things.

For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes.

In the case of OSS, the pool of resources is likely far bigger than with closed source software.

That's how the theory goes, but how often does this really happen though? See: OpenSSL

The simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.

Google's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.

Hehe, "favor"

On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.

Is github itself open source tho?

Well I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)

Encrypted with a widely known (people have blogged it) key.

> But that's "source code available", not "open source" (ie, under a copyleft license)

It's proprietary. Also, there are many free software (or "open source" if you prefer) licenses that are not copyleft. MIT, Apache, Revised BSD, zlib, etc are all examples.

No, but a company paid a bounty for a leak in Rails, which is open source. Isn't that what this topic was about?

Well, the kernel, right? Many many major corporate contributors. Kind of the opposite of OpenSSL, I guess, which everyone uses and no one seems to maintain.

See: BoringSSL

You say that like Heartbleed was the end of the story. Since then, "the Linux Foundation launched the Core Infrastructure Initiative (CII) as a way of getting resources to those projects. That has helped OpenSSL, among others, to get back into a healthy state." which includes a ton of funding from many companies that depend on OpenSSL like AWS, Google, Intel, Microsoft.

https://lwn.net/Articles/702751/

Many companies large and small already pay penetration testers to try into break into their Linux-based servers on a regular basis.

I was personally involved in a case where a recognizable brand's pen testing effort lead to a fix a well-used piece of open source software.

There is a lot of open source is already being fixed thanks to commercial interests.

Facebook, Github, and Microsoft already co-sponsor a well-funded open-source "Internet bug bounty".

If you think about it, it was always that way. However, a lot of companies that depend upon open source software also invest on it, so it also gets a reasonably good number of eyes trying to fix bugs and add features.

> OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can.

Software insurance companies can invest a part of the insurance premium on OSS in bug bounties. It’s a shame more people aren’t aware of software insurance, since OSS has several advantages in this area, for example that the source code is available to everyone, such that insurance companies can pay everyone in the world to find bugs in the software they’re insuring.

That’s a definite advantage. It’s not often that an insurance company has the opportunity to invite everyone in the world to help them assess the quality of what they’re insuring.

To begin with, some OSS doesn't even know how to treat people who report bugs.

Citation needed

The average OSS project probably is better about that than the average software company though - at least with OSS projects you can be reasonably secure that they won't send lawyers or the police after you for finding bugs.

It is also easier for an outsider to figure out where to report the bug.

I had a bug using NLTK to display parse trees in Jupyter notebooks. NLTK uses tkinter to render the parse trees to PostScript and GhostScript to produce a png image. The chain broke when the PostScript output had a font size of 0.

If this had been a bug in a closed-source program, all I could have put in a bug report would have been "doesn't work, pls fix".

Instead, I could submit a workaround to NLTK and start looking for the reason tkinter generated malformed PostScript output. This turned out to be because Tcl/Tk's font handling used Xft, which used FontConfig, and used an integer for the font size where FontConfig expected a double. Everything worked fine until FontConfig started doing floating point math on the font size. The Tk maintainer who triaged my bug report couldn't even reproduce it on his system, because his version of FontConfig only ever copied the value.

Only because every component of the chain was open source, was it possible to track the bug down and fix it.

Maybe we should start some sort of foundation dedicated to providing the same incentive to find bugs in OSS

I'd imagine there are a lot of programmers who would be interested in supporting something like this

You mean something like The Internet Bug Bounty?

I think that is already the case to some extent.

It seems like this might be in part balanced by the fact that it's much easier to find vulnerabilities in open source software, since it's open source.

Mozilla has a bug bounty.

OSS already had bug bounties a long time ago.

Reply on news.ycombinator.com