Posted on 08/04/2004 10:37:19 AM PDT by ShadowAce
A string of high-profile flaws in browser software prompted the Mozilla Foundation to announce on Monday that it would offer $500 for every serious bug found by security researchers.
The announcement comes a week after the Mozilla Foundation, which directs development of the Mozilla and Firefox browsers and the Thunderbird e-mail client, confirmed that the group's browsers had two serious issues in dealing with digital certificates, the identity cards of the Internet. Last Friday, Microsoft fixed serious vulnerabilities in its Internet Explorer browser, some of which have been widely known since June.
"Recent events illustrate the need for this type of commitment," Mitchell Baker, president of the Mozilla Foundation, said in a statement. "The (program) will help us unearth security issues earlier, allowing our supporters to provide us with a head start on correcting vulnerabilities before they are exploited by malicious hackers."
Linux software maker Linspire and Internet entrepreneur Mark Shuttleworth funded the new initiative, dubbed the Mozilla Security Bug Bounty Program. Linspire seeded the program with $5,000, and Shuttleworth promised to match the first $5,000 in public contributions to the program, the foundation stated.
"We (the Mozilla Foundation) are moving into our second year, and we are going back and reviewing all the programs in place that we had in the past and setting priorities for the next year," said Chris Hofmann, director of engineering for the foundation. "Security is an area that we are serious about, and we wanted to get the ball rolling." He added that the foundation will continue to look for more contributors to the program.
Hofmann said that despite the bugs, Mozilla's security is good. Some critics have maintained that Mozilla's software has at least as many vulnerabilities as Microsoft's and that the only difference between the two applications is that Microsoft is more popular, so more security researchers are trying to break it.
"The conventional wisdom is that if Mozilla had the same market share as Microsoft, we would have as many flaws found--we don't see that as the case," Hofmann said.
A representative of Microsoft could not immediately be reached for comment.
Few companies have offered rewards for pinpointing software vulnerabilities, and the rewards have almost always been paid by security companies for flaws in other companies' software products. The rewards are generally used by security companies to gain a competitive edge over rivals by having their products recognize more vulnerabilities. The rewards also convince some would-be intruders to give up some of the tricks in their tool kit for quick cash.
However, a $500 reward might not be very enticing--a point Hofmann acknowledges. "We don't have any intentions of increasing that amount," he said. "It is mostly a way to thank people who help us further the security of the product."
Microsoft does not give bounties to bug finders but did start a program that has posted three $250,000 rewards for leads on virus writers.
Currently, the Mozilla Web application--which includes a browser, e-mail, chat program, and Web page editing program--has reached version 1.7. The Mozilla Foundation's Firefox stand-alone browser and Thunderbird e-mail client are close to being complete and are already widely used.
Gee--I wonder why? This is the way to improve software, people. Be open to bug reports and then fix them in a timely manner.
bump for later....
I don't have my full ping list here, so if anyone is missing please don't hesitate to ping them for me.
Ha! The best way to increase the number of bugs is to start handing out money to "discover" them.
I like the difference in approaches. Microsoft rewards people who chase down those who exploit its buggy software after the damage is done, while Mozilla rewards those who help get bugs fixed before they can be exploited.
Which has the interests of their customer base more at heart?
BTW, if you read the whole thing at Mozilla, spotting a critical bug also gets you into the inner circle of developers if you want. I think the elevated status in the community will be worth more to a lot of people than the $500.
They've already thought of Wally's "I'm gonna write me a minivan this morning" and worked around it.
You beat me to it. I guess Mozilla development isn't going as well as they thought, and open-sourcing the whole thing without these "bounties" isn't exactly lucrative for the developers.
Full disclosureI'm one of the rare types that uses both IE and Mozilla.
What does Micr'soft pay its people to do?
Well--it's obviously not to find bugs.
Heck....microsoft wants me to pay $500 for their bugs.
MS calls it an upgrade!
This is clear evidence that the "many eyes" theory of finding bugs is a sham.
Is this why a new Firefox incremental update has been released today? Or are there other things within that make it worth taking the time to upgrade?
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.