Feeds

Mozilla to pay bounty on bugs

Wanted: Dead or alive

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Users who identify and report serious security vulnerabilities involving Mozilla are to be rewarded for finding bugs in the open source Web browser software.

The Mozilla Security Bug Bounty Program, launched yesterday, promises a reward of $500 to anyone who finds a "critical" security bug in Mozilla. What constitutes critical will be judged by the Mozilla Foundation staff. Linux software developer Linspire and Mark entrepreneur Shuttleworth have issued seed funding to support the initiative, to be supplemented by donations from Mozilla supporters. The first $5,000 in community contributions will be matched dollar-for-dollar by Shuttleworth.

Mozilla already has a good record of promptly fixing any security problems that arise. The Mozilla Security Bug Bounty Program seeks to further encourage the community's focus on security consciousness and responsiveness. The level of reward has been pitched quite low - if somebody found an exploit they'd doubtless make more money via security firm iDefense's controversial vulnerability contributor program - but that's not really the point. The Mozilla program is probably best viewed as a symbolic gesture of thanks to those who take the trouble to find and report bugs than as a way of providing a financial incentive to expand the number of people looking for problems involving Mozilla.

"This program reflects our commitment to protecting consumers from malicious actors," said Mitchell Baker, President of the Mozilla Foundation. "Recent events illustrate the need for this type of commitment. While no software is immune from security vulnerabilities, bugs in open source projects are often identified and fixed more quickly. The Security Bug Bounty Program will help us unearth security issues earlier, allowing our supporters to provide us with a head start on correcting vulnerabilities before they are exploited by malicious hackers [crackers]."

Users who identify security bugs in Mozilla software are encouraged to go to Mozilla.org/security, which links to more information about which flaws are eligible and how to claim the bounty. ®

Related stories

Mozilla takes bite out of IE
Mozilla bug rears its head
CERT recommends anything but IE
Long-awaited IE patch (finally) arrives
MS posts $250,000 MyDoom worm bounty
MS' anti-virus bounty success
Computer Security: a handbook for the ordinary user (book review)

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.