The goal was to create a framework through which people could safely test and report exploits. In addition, 4chan isn't in a financial position to dole out large bounties.
This is one of those cases where the $20 is probably worse than $0, though (even though it's non-cash). It's like "hey, friend, will you (help me move|have sex with me|etc)"; more likely to do it as a favor than when $20 is offered. Probably even more likely to do it for $1k than as a favor. $1000>0>$20.
Much better to frame things as a way to show off to peers, help the community, etc.
http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-th...
It seems like if Google were to offer a $1M bug bounty tier, it'd be much more likely that Vupen's exploits would be discovered by someone else.
I totally understand that you can't offer a $1,000 bounty, you aren't Google or Facebook.
Would it be possible, however, to take donations (cryptocurrencies?) that can be used specifically for the bounties? I'd put in 50k DOGE towards that, and I'm sure others would too.
I appreciate the kind gesture, but I really hate accepting donations, and to that end we haven't accepted any in ~8.5 years.
> wants people to pay for contributing to the site
The reason you feel against donations is because you probably have a negative psychological view of accepting help. You probably feel that you bother people when you want to ask them for free help in real life.
Well this mental block you have is not true to the world. You should do what other good entrepreneurs do and stop putting your own limiting beliefs onto your non-profit business.
All of our codebase (the core application and related tools) has been closed-source from day one. Not sure what you're referring to.
Yes. Why? The imageboard community is full of awful scripts. Yotsuba has a lot of really wonderful features. It would be great for the world if you were to release Yotsuba on Github or something.
Futallaby isn't closed source, BTW.
Personally I believe 4chan seems like a good candidate for the MEAN stack. A lot of the features and boards could be coded as modules and it seems like it would be a lot easier to maintain, but of course this is mostly speculation. What might be cool is if 4chan/moot sanctioned an opensource project (or had a competition) to see if users could create a good open source "foundation" for 4chan and other image boards, then open sourced what was built off of that. I know 4chan has been "re-written" but I imagine some of the code is still original and I don't think any one expects it to be "professional quality" simply because it was written by someone who was (probably) completely new to web coding, so I can see why it may not make since to open source what they have already because it could lead to more bugs than it fixes.
At any rate, I don't think we'll be seeing an open source release of the 4chan source in the near future. Obviously I don't know the specifics, but in my experience it seems like most purpose-built internal applications like the 4chan imageboard tend to be rather messy and filled with a lot of very specific code that's hard to repurpose for more general use. In order to release it publicly, the codebase has to be sanitized of private information, disentangled from any internal utilities or applications, refactored to remove ugly hacks that solve one-off problems (ex. legacy integration), and so on. Then they have to switch 4chan itself over to the new codebase if they ever hope to keep the public repo up to date. That's a lot of work for 4chan's volunteer labor force, on top of what they already have to expend to maintain the site.
There's also a good likelihood that the volunteers who contributed to the code have not done so in a way that would allow moot to release the source. I am not a lawyer so I can't speak confidently about this, but I'm pretty sure copyright is a major issue here. Unless every volunteer contributor has explicitly agreed to allow their code to be released or directly assigned copyright to moot, the first prerequisite to an FOSS release would probably be to get that permission from every contributor, both past and present. The present contributors may not be that hard to ask, but given the nature of 4chan I wouldn't be surprised if a few past volunteers have worked under personas they've since abandoned, effectively making them unreachable.