For about the past six years, Mozilla has been putting cash bounties on bugs, and more recently, the open-source company upped the reward from $500 to $3,000. Not a bad score for researchers who make it their business to hunt down bugs and turn them in, but for some, it's not about the money.
In fact, roughly 10-15 percent of the serious security flaws reported to Mozilla since the cash bounty program was first offered have been provided at no cost.
"A lot of people would say, 'Don't worry about it. Donate it to the eFF (Electronic Frontier Foundation) or just me a T-shirt,'" said Jonathan NighingaleDevelopment Director, Firefox, in a recent interview.
Turning down the cash for reporting clunky browser behavior is made even more impressive considering these bugs can sometimes fetch even more money in the underground market. Cyber crooks are always on the lookout for rogue software to infect people's machine, and Mozilla's cash bounty is an attempt to counter this practice.
"In North America, $3,000 is not nothing," Nightingale added. "But in a lot of the world, $3,000 is a big deal, and our contributors come from lots of places."

0 comments:
Post a Comment