CSC 379 SUM2008:Week 3, Group 1: Difference between revisions
| Line 5: | Line 5: | ||
* ''Software will become more secure.'' By rewarding individuals for their time and effort, people are given an incentive to expose and report more bugs. As these bugs are fixed, software becomes more robust and safer to use. | * ''Software will become more secure.'' By rewarding individuals for their time and effort, people are given an incentive to expose and report more bugs. As these bugs are fixed, software becomes more robust and safer to use. | ||
* ''They will make it easier to report a bug.'' Markets will facilitate people who would otherwise not come forward with bugs due to frustration with reporting them the software vendors in the past.[http://news.cnet.com/Oracle-dragging-heels-on-unfixed-flaws%2C-researcher-says/2100-1002_3-5795533.html] | * ''They will make it easier to report a bug.'' Markets will facilitate people who would otherwise not come forward with bugs due to frustration with reporting them the software vendors in the past.[http://news.cnet.com/Oracle-dragging-heels-on-unfixed-flaws%2C-researcher-says/2100-1002_3-5795533.html] | ||
== Background == | |||
There is a growing underground market for malware, which grows more sophisticated by the day.[http://www.fstc.org/docs/articles/messaglabs_online_shadow_economy.pdf] As such, it is important for nonmalicious software developers to stay ahead. One method is to ensure that the code they produce contains as few security holes as possible. However, programmers are hardly perfect, and bugs will manage to slip through the cracks. It is therefore important that developers be made aware of these bugs as they are discovered. This page attempts to address the merits and demerits of paying third parties to do just that. | |||
== Arguments Against The Use of These Markets == | == Arguments Against The Use of These Markets == | ||
Revision as of 22:54, 25 July 2008
Markets for Bug Reports
Is it good to encourage the formation of a market for bug reports where people who find bugs could be paid for their efforts? How about the danger that hackers might outbid developers and use this information and exploit the bug to reek havoc on users of the application? Can this danger be avoided by regulating the market? How can such of regulation succeed in practice? What about the problem of markets in other countries? In response to these concerns should software companies establish a policy of refusing to pay for bug reports?
Arguments For The Use of These Markets
- Software will become more secure. By rewarding individuals for their time and effort, people are given an incentive to expose and report more bugs. As these bugs are fixed, software becomes more robust and safer to use.
- They will make it easier to report a bug. Markets will facilitate people who would otherwise not come forward with bugs due to frustration with reporting them the software vendors in the past.[1]
Background
There is a growing underground market for malware, which grows more sophisticated by the day.[2] As such, it is important for nonmalicious software developers to stay ahead. One method is to ensure that the code they produce contains as few security holes as possible. However, programmers are hardly perfect, and bugs will manage to slip through the cracks. It is therefore important that developers be made aware of these bugs as they are discovered. This page attempts to address the merits and demerits of paying third parties to do just that.
Arguments Against The Use of These Markets
Additional Links
- http://bits.blogs.nytimes.com/2007/07/06/a-new-market-for-software-flaws/#more-206
- http://www.techcrunch.com/2007/07/06/hackers-ebay-legitimate-marketplace-or-organized-blackmail/
- http://www.crn.com/security/201800238
- http://www.fstc.org/docs/articles/messaglabs_online_shadow_economy.pdf
- http://news.cnet.com/Offering-a-bounty-for-security-bugs/2100-7350_3-5802411.html