Feeds

Google to award bounties for fixing non-Google open source code

Patch pillars of the internet, earn valuable crumbs

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Google is expanding its bug bounty program to include awards for patches that make material security improvements to open source software - even when the software isn't directly maintained by Google itself.

The Chocolate Factory has been rewarding developers for security fixes to its own software since 2010, when it kicked off its bounty program for the Chrome web browser. Now the company says it will also shell out cash to developers who submit fixes to select non-Google software, too.

To qualify for the program, developers must produce "down-to-earth, proactive improvements that go beyond merely fixing a known security bug," according to a blog post by Google security team member Michal Zalewski on Wednesday.

Initially, the bounty program applies only to a select group of open source projects, such as the OpenSSL and OpenSSH secure communications libraries, the BIND DNS software, and security-critical components of the Linux kernel, to name a few.

After an initial trial period, it will be expanded to include even more projects, including such popular packages as the Apache webserver, the Sendmail, Postfix, and Exim email servers, and the Gnu software development tools.

Zalewski said Google chose this selective approach because it believes it will be more productive than offering bug bounties for just any old open source software.

"In addition to valid reports, bug bounties invite a significant volume of spurious traffic – enough to completely overwhelm a small community of volunteers," he wrote. "On top of this, fixing a problem often requires more effort than finding it."

Aside from ponying up the cash, Google's approach will be mostly hands-off. Developers don't need to clear their fixes with Mountain View before submitting their patches. Instead, they should submit them directly to the maintainers of the projects in question. Once the patches are accepted and the updated code has shipped, they can then email security-patches@google.com with a description of what they did.

"If we think that the submission has a demonstrable, positive impact on the security of the project, you will qualify for a reward ranging from $500 to $3,133.7," Zalewski writes.

In fact, the online ad giant may choose to cough up even more in cases of "unusually clever or complex submissions" – the actual amount of each award being left to Google's sole discretion.

Then again, some developers may choose to contribute security patches strictly out of a sense of duty. In these cases, Google says they can opt to donate their bounty awards to charity and it will match their donations. Bounties that haven't been claimed after 12 months will be donated to a charity of Google's choice. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.