Re:$100k donation to the Internet Bug Bounty
by franciscop on Friday July 21, 2017 @08:56PM
(#14824834)
First it seems to be for any kind of open source:
Mission Partners
The Mission Partners track is open to any free software / open source project
that significantly furthers Mozilla’s mission to ensure the Internet is a
global public resource, open and accessible to all.
But later on it specifies something that aligns quite well with Mozilla's principles:
Activities which are not sufficient for an award on their own include:
Writing open source software (notwithstanding manifesto principle #7)
Building something cool with web technologies
Translating open source software into another language
And it should be endorsed by someone well-known:
The specific project activity should be endorsed (on the application form) by someone well-known [...]
Which... is quite hard and not just any kind of open source project. It seems you have to be high profile already to even opt for it, then do something along Mozilla's main principles.
Re:$100k donation to the Internet Bug Bounty
by rnprince on Friday July 21, 2017 @04:47PM
(#14823654)
I wondered for a moment if this could incentive developers to introduce bugs for their friends to "find," but then I remembered that hackers are already incentivized a lot more to sneak vulnerabilities into FOSS.
Re:$100k donation to the Internet Bug Bounty
by ufmace on Friday July 21, 2017 @07:18PM
(#14824474)
IMHO that would be a legitimate use of the award. If your review and merge process is bad enough that somebody can get malicious code into your releases, then that's a serious bug in your process, and whoever proved that it's there deserves the bounty just as much as someone who found an ordinary bug.
Re:$100k donation to the Internet Bug Bounty
by thephyber on Friday July 21, 2017 @05:04PM
(#14823749)
They are, but they also host any OSS project for free, which is the only reason I know about the brand "GitHub". I think you severely underestimate how valuable that mindshare can be. Also, they depend heavily on products which depend on OSS projects for their product.
It only makes sense that GitHub would want to reinvest in security for their own supply chain. The only problem is that most other companies don't do enough of the same.
Re:$100k donation to the Internet Bug Bounty
by Kiro on Friday July 21, 2017 @04:46PM
(#14823647)
They're making fun of the overly negative comments that take over every thread about companies doing something seemingly good. It was my first thought as well: "let's see how HN twists this into something bad".
It only makes sense that GitHub would want to reinvest in security for their own supply chain. The only problem is that most other companies don't do enough of the same.