Hacker News Reader

The author launched a bug bounty program for open source projects: https://bountygraph.com/.

That's a wonderful endeavor and I would gladly try to "convince" people I know to pledge money in it.

Monetary incentives are important for open source maintainers, as they cannot always afford the time to work on their projects.

View on HN

I don't know exactly how that bug bounty program works, but it feels like there may be some fundamental issues with bug bounties in the context of open source projects.

For example, what is there to prevent someone from introducing a bug into an open source project, first of all, and then subsequently claiming a bounty for identifying and/fixing it?

(Maybe this can end up by forcing more careful pull request auditing for security critical projects, but that seems like a big ask..)

Reply on news.ycombinator.com