Re:Announcing the Windows Bounty Program
by efdee on Wednesday July 26, 2017 @03:51PM
(#14859604)
That's how the theory goes, but how often does this really happen though? See: OpenSSL
[ Parent
| on HN ]
The simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.
Re:Announcing the Windows Bounty Program
by bitmapbrother on Wednesday July 26, 2017 @10:17PM
(#14862173)
Google's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.
Re:Announcing the Windows Bounty Program
by lawnchair_larry on Thursday July 27, 2017 @12:18AM
(#14862684)
Hehe, "favor"
Re:Announcing the Windows Bounty Program
by sliverstorm on Wednesday July 26, 2017 @04:25PM
(#14859951)
Well, the kernel, right? Many many major corporate contributors. Kind of the opposite of OpenSSL, I guess, which everyone uses and no one seems to maintain.
Re:Announcing the Windows Bounty Program
by skrebbel on Wednesday July 26, 2017 @04:17PM
(#14859856)
On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
Is github itself open source tho?
No, but a company paid a bounty for a leak in Rails, which is open source. Isn't that what this topic was about?
Well I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)
> But that's "source code available", not "open source" (ie, under a copyleft license)
It's proprietary. Also, there are many free software (or "open source" if you prefer) licenses that are not copyleft. MIT, Apache, Revised BSD, zlib, etc are all examples.
Encrypted with a widely known (people have blogged it) key.
You say that like Heartbleed was the end of the story. Since then, "the Linux Foundation launched the Core Infrastructure Initiative (CII) as a way of getting resources to those projects. That has helped OpenSSL, among others, to get back into a healthy state." which includes a ton of funding from many companies that depend on OpenSSL like AWS, Google, Intel, Microsoft.