<story><title>Announcing the Windows Bounty Program</title><url>https://blogs.technet.microsoft.com/msrc/2017/07/26/announcing-the-windows-bounty-program/</url></story><parent_chain><item><author>efdee</author><text>That&amp;#x27;s how the theory goes, but how often does this really happen though? See: OpenSSL</text></item><item><author>jklein11</author><text>Similar behaviors likely exists in OSS they are just called different things.&lt;p&gt;For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes.&lt;p&gt;In the case of OSS, the pool of resources is likely far bigger than with closed source software.</text></item><item><author>tiffanyh</author><text>I wonder what impact this will have on open source software (OSS).&lt;p&gt;OSS can&amp;#x27;t afford to pay people to look for bugs and improve the overall software. But commercial companies can.&lt;p&gt;I wonder if there will exist a date&amp;#x2F;time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.</text></item></parent_chain><comment><author>tptacek</author><text>The simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.</text></comment>
<story><title>Announcing the Windows Bounty Program</title><url>https://blogs.technet.microsoft.com/msrc/2017/07/26/announcing-the-windows-bounty-program/</url></story><parent_chain><item><author>efdee</author><text>That&amp;#x27;s how the theory goes, but how often does this really happen though? See: OpenSSL</text></item><item><author>jklein11</author><text>Similar behaviors likely exists in OSS they are just called different things.&lt;p&gt;For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes.&lt;p&gt;In the case of OSS, the pool of resources is likely far bigger than with closed source software.</text></item><item><author>tiffanyh</author><text>I wonder what impact this will have on open source software (OSS).&lt;p&gt;OSS can&amp;#x27;t afford to pay people to look for bugs and improve the overall software. But commercial companies can.&lt;p&gt;I wonder if there will exist a date&amp;#x2F;time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.</text></item></parent_chain><comment><author>skrebbel</author><text>On the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I&amp;#x27;m no expert, but it appears to me that at times it does work, just not always.</text></comment>