That's how the theory goes, but how often does this really happen though? See: OpenSSL
The simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.
Re:Announcing the Windows Bounty Program
by bitmapbrother on Wednesday July 26, 2017 @10:17PM
(#14862173)
Google's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.
Re:Announcing the Windows Bounty Program
by lawnchair_larry on Thursday July 27, 2017 @12:18AM
(#14862684)
Hehe, "favor"
Re:Announcing the Windows Bounty Program
by sliverstorm on Wednesday July 26, 2017 @04:25PM
(#14859951)
Well, the kernel, right? Many many major corporate contributors. Kind of the opposite of OpenSSL, I guess, which everyone uses and no one seems to maintain.
Re:Announcing the Windows Bounty Program
by skrebbel on Wednesday July 26, 2017 @04:17PM
(#14859856)
On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
Is github itself open source tho?
No, but a company paid a bounty for a leak in Rails, which is open source. Isn't that what this topic was about?
Well I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)
> But that's "source code available", not "open source" (ie, under a copyleft license)
It's proprietary. Also, there are many free software (or "open source" if you prefer) licenses that are not copyleft. MIT, Apache, Revised BSD, zlib, etc are all examples.
Encrypted with a widely known (people have blogged it) key.
You say that like Heartbleed was the end of the story. Since then, "the Linux Foundation launched the Core Infrastructure Initiative (CII) as a way of getting resources to those projects. That has helped OpenSSL, among others, to get back into a healthy state." which includes a ton of funding from many companies that depend on OpenSSL like AWS, Google, Intel, Microsoft.
For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes.
In the case of OSS, the pool of resources is likely far bigger than with closed source software.