The blog of Xeno, a slightly mad scientist
Google said Wednesday it plans to reward developers for developing proactive security improvements for some of the most widely used open-source software programs.
The program aims to “improve the security of key third-party software critical to the health of the entire Internet,” wrote Michal Zalewski of Google’s Security Team. Rewards will range between US$500 to $3,133.70, he wrote.
Google decided against creating merely a bounty program for open source code.
“In short, we decided to try something new,” according to Google’s description of the program. “Quite a few vulnerabilities trace back to preventable coding mistakes, or are made easier to exploit due to the absence of simple mitigation techniques. We are hoping to address this to some extent.”
The kind of polishing Google is looking for include fixes involving privilege separation, memory allocator hardening, cleanups of integer arithmetics, and fixes for race conditions, according to the program’s rules.
Open-source software projects are usually maintained by unpaid volunteers, although some companies that have built businesses around open-source software have full-time employees that contribute code.
Google’s program potentially adds a financial incentive to what was otherwise usually unpaid work done out of sheer dedication. Google already runs its own vulnerability reward program, but it only applies to its own products.