Forgot your password?
typodupeerror
Bug

Bug Bounties Don't Help If Bugs Never Run Out 232

Posted by Soulskill
from the trying-to-bail-the-ocean dept.
Bennett Haselton writes: "I was an early advocate of companies offering cash prizes to researchers who found security holes in their products, so that the vulnerabilities can be fixed before the bad guys exploited them. I still believe that prize programs can make a product safer under certain conditions. But I had naively overlooked that under an alternate set of assumptions, you might find that not only do cash prizes not make the product any safer, but that nothing makes the product any safer — you might as well not bother fixing certain security holes at all, whether they were found through a prize program or not." Read on for the rest of Bennett's thoughts.

Comment: Re:*Yawn* I'll Wait for the Mint Edition (Score -1) 172

by YourMissionForToday (#46782637) Attached to: Ubuntu Linux 14.04 LTS Trusty Tahr Released

Yes, it's in one monolithic file.

Try making a minor typo in the syntax, then restart networking. You will lose all network connectivity on ALL interfaces.

Fix your typo and try to start networking again. It won't work until you reboot.

Or you can try adding your config to one of the seemingly infinite network config subdirectories (ifup.d, post-ifup.d, etc). Make the same typo anywhere in the subdirectories and you'll still mess up all networking and have to reboot.

I guess this is acceptable if you haven't used any OS besides Windows 98. For the rest of us it's maddening.

Comment: Re:Ukraine's borders were changed by use of force (Score 1) 297

by gmhowell (#46764195) Attached to: Is Crimea In Russia? Internet Companies Have Different Answers

Honestly I don't get the stance of some ppl from the US against Russia.
Russia is the best friend and has been the most loyal, the strongest and the most valuable ally for the USA. Really. At times of apocalyptic events Russians and Americans stood together. It was before and it may be again when we have to save the Earth itself. Nobody can help the US but Russia when things get hot. Alienating Russians is what make things worse.

Those things are called movies. The space aliens didn't really invade Earth.

Idiot, he was referring to the documentary about the asteroid that they blew up with the nuke. You know, when Daredevil makes out with Arwen.

Comment: Re:Shareholders profits? (Score 1) 145

by gmhowell (#46764147) Attached to: How Amazon Keeps Cutting AWS Prices: Cheapskate Culture

Replying to myself: I assumed they would cut expenses to feed the shareholders but I was wrong. TFA explains:

Amazon generated a whopping $74.45 billion in revenue for its financial year to 31 December 2013, but just $274 million in net income, a margin of roughly 0.3 percent. It sells Kindles at cost.

Compare this with Google, which saw net income of $12.9 billion on revenues of $59.8 billion for the year to 31 December 2013, a margin on 21.6 percent; or to Microsoft, which posted revenue of $77.9 billion for the year to 30 June, with a net income $21.9 billion, a margin of 28.1 percent

Question is: how do they manage to make shareholders accept that?

I'm guessing the investors expect Amazon to become and stay the Walmart of the internet (or perhaps the Sears and Roebuck from catalog days) and be be able to either ramp up margins or pay them at that level for a LONG time.

Comment: Re:Why is this crap on the internet (Score 1) 95

by gmhowell (#46762409) Attached to: Lack of US Cybersecurity Across the Electric Grid

It was actually wishful thinking rather than faith. I've seen the same things you describe. I've also seen where things like this are swept under the rug forever. Then, the root cause analysis comes back and people flip shit because nothing was done about it in the past. Well, nothing other than ignore the recomendations of us morlocks...

Comment: Re:Ex Post Facto Law (Score 1) 630

by gmhowell (#46761729) Attached to: IRS Can Now Seize Your Tax Refund To Pay a Relative's Debt

And yet Article 1, Section 9 makes no distinction between civil and criminal. How did the 'precedent' (pronounced 'bullshit') get set that this only refers to criminal issues?

If what he said is true, then this is yet another (out of many) example of the courts 'creatively interpreting' (in other words, modifying it with invisible ink) the constitution.

Sure, it's a wikipedia link, but it's trivial to verify.

Comment: Re:de Raadt (Score 1) 289

by Dahan (#46760219) Attached to: OpenBSD Team Cleaning Up OpenSSL

Bitch about this instead. A fucking static checker found heartbleed.

No, it says, "Coverity did not find the heartbleed bug itself", which very clearly means that Coverity did not find Heartbleed. And Coverity themselves confim that Coverity does not detect the problem (though in response, they've added a new heuristic that does detect it, but no word on how the new heuristic affects the false positive rate).

At these prices, I lose money -- but I make it up in volume. -- Peter G. Alaquon

Working...