Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Google Fixes 10 Bugs In Chrome, Pays $4000 Bounty

samzenpus posted more than 3 years ago | from the $400-flaw dept.

Google 114

Trailrunner7 writes "It seems Google's bug bounty program is paying some nice dividends, for both sides. Less than two weeks after releasing version 6.0 of its Chrome browser, Google has pushed out another Chrome release, which includes fixes for 10 security bugs, seven of which are rated either critical or high. Google Chrome 6.0.472.59 comes out just 12 days after the last Chrome release, which fixed 14 security bugs. As part of its bug bounty program, Google paid out $4,000 in rewards to researchers who disclosed security flaws in the browser. Most of the security flaws fixed in the new release are in the Windows version of Chrome, but the most serious bug is only in Chrome for Mac."

cancel ×

114 comments

Sorry! There are no comments related to the filter you selected.

fp? (1, Funny)

nomorecwrd (1193329) | more than 3 years ago | (#33592660)

I'm posting from Chrome... should I report a bug if I do not get first post due to latency?

Macs (-1, Troll)

Traze (1167415) | more than 3 years ago | (#33592662)

Apple products have no bugs! Or viruses either!

/sarcasm

Re:Macs (0)

Anonymous Coward | more than 3 years ago | (#33592706)

It isn't an Apple product.

Re:Macs (3, Funny)

nomorecwrd (1193329) | more than 3 years ago | (#33592790)

It isn't an Apple product.

'cuz if it where, the system would reboot if you use the mouse and keyboard simultaneously.


Just don't type like that!!

Re:Macs (1)

Yvan256 (722131) | more than 3 years ago | (#33593144)

Stop trolling, my Mac never rebooted while I us@$#![]5;ca'?!2goAg=

Re:Macs (2, Funny)

Yvan256 (722131) | more than 3 years ago | (#33593164)

5[f;'~R:'`#&gZ{=ahile I used the mouse and keyboard simultaneously.

Re:Macs (3, Funny)

BlackSnake112 (912158) | more than 3 years ago | (#33593216)

Rebooting, logging in, and connecting back to slashdot in under a min. Apple machines are fast.

bounty (-1, Troll)

Anonymous Coward | more than 3 years ago | (#33592668)

so?

Re:bounty (-1, Offtopic)

Achromatic1978 (916097) | more than 3 years ago | (#33592994)

This. I think this is like the fourth article I've seen that says 'security fix for chrome, google pays 1, 2, 4 grand in bounties".

Who cares?

why are the bounties so low? (2, Insightful)

Surt (22457) | more than 3 years ago | (#33592698)

Surely Google could easily afford 10 (maybe even 100) times as much, and that would undoubtedly get a lot more people interested in looking. If they want to win the security war, they should be ramping up the bounties each release.

Re:why are the bounties so low? (2, Interesting)

Halifax Samuels (1124719) | more than 3 years ago | (#33592818)

Yes, but what if they paid 10-100 times more and ended up having to pay for 10-100 times more valid bounties due to the increased popularity? It wouldn't look good for them if they had to back down on paying what they promised due to more volume than they intended.

Not to mention this would create incentive for employees to try intentionally leaving bugs in the code and telling friends how to fix them, trying to wring bounty money from their employer.

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33592882)

At 10x$400 = $4K per bug, 10*10 = 100 bugs = $400,000 in bounties. Trivial to a company with a profit margin in the 3 billion range.
At 100x$400 = 40K per bug, 10*100 = 1000 bugs = $40 million in bounties. Real money, but still affordable.

Re:why are the bounties so low? (1)

lgw (121541) | more than 3 years ago | (#33593148)

You'd want to keep the bounties low enough that the Google employees working on Chrome aren't incented to create a backchannel (there was a good Dilbert about this, long ago).

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33593332)

A back-channel would be pretty tough to create and not get caught. At $40k it MIGHT be worth the risk of their job to a googler (if they were pretty stupid), but at $4k it would almost certainly not be worth the risk.

On your sig: A 121K debt per taxpayer sounds like a lot until you think about paying that off over a 30-40 year working lifetime. Plus, you know that's going to be heavily reduced by inflation. 2015-2025 we're probably going to have 10-15% inflation per year, which will turn that into only 46K or less in today's dollars. Over a 40 year working life, that's like 1K extra in taxes per year. Call me when it hits 10K in extra taxes per year.

Re:why are the bounties so low? (1)

Skim123 (3322) | more than 3 years ago | (#33594078)

On your sig: A 121K debt per taxpayer sounds like a lot until you think about paying that off over a 30-40 year working lifetime. Plus, you know that's going to be heavily reduced by inflation. 2015-2025 we're probably going to have 10-15% inflation per year, which will turn that into only 46K or less in today's dollars. Over a 40 year working life, that's like 1K extra in taxes per year. Call me when it hits 10K in extra taxes per year.

121K debt per taxpayer is what the national debt is right now. Your whole formula presupposes that the debt won't rise another penny from now through the next 30-40 years. Is that at all likely? The GAO estimates Social Security and Medicare obligations alone will cost us roughly 12 TRILLION in borrowed dollars (in total) between now and 2040 (not adjusted for inflation). And have you seen the proposal for the upcoming fiscal year? We'll be running a $1.6 TRILLION dollar deficit.

We have reason to be worried about the US deficit and debt. There will certainly be a day of reckoning in our lifetimes.

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33595604)

There will absolutely be a reckoning, and it will involve massive inflation, for which I am personally well positioned.

Re:why are the bounties so low? (1)

Skim123 (3322) | more than 3 years ago | (#33595668)

There will absolutely be a reckoning, and it will involve massive inflation, for which I am personally well positioned.

Care to elaborate? Did you borrow a lot of money at a locked in rate to buy gold, per chance?

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33599614)

Not gold, but yes, borrowed a lot to buy assets that have held a historically 'fixed' price relative to inflation.

Re:why are the bounties so low? (1)

lgw (121541) | more than 3 years ago | (#33594426)

On your sig: A 121K debt per taxpayer sounds like a lot until you think about paying that off over a 30-40 year working lifetime. Plus, you know that's going to be heavily reduced by inflation. 2015-2025 we're probably going to have 10-15% inflation per year, which will turn that into only 46K or less in today's dollars. Over a 40 year working life, that's like 1K extra in taxes per year. Call me when it hits 10K in extra taxes per year.

How many people do you know who can pay off say $40K in credit-card debt given their entire life to do so (without a housing bubble to hide things)? I managed it, but some real austerity was required. I fear some real austerity will be required for the nation as a whole.

Also, that debt number is going up faster than your $1K/year right now! (Check back to that link from week to week - it's frankly frightening). Talk of paying it down is a bit silly if we can't control ourselves even to the point of keeping it level. I say "we" becuase this is still a (representative) democracy - the government only mirrors our collective lack of self-control.

(And you can't inflate your way out of short-term debt, you'll just have to borrow at the new, higher rates if you can't pay it off, and long term rates will jump like crazy if your intent to inflate your way out becomes apparent, so you'll only have short-term borrowing available. It's already $10K per year, and the Laffer curve probably prevents us from raising tax revenues by that much.)

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33599592)

Almost everyone could pay off a 40k credit card debt given either of two things the US government has:

1) interest rates in the <6% range.
2) the power to print money.

Finally, it's nowhere near 10k in taxes per year. You lose the argument with me when your numbers diverge into fantasyland.

Re:why are the bounties so low? (1)

Peach Rings (1782482) | more than 3 years ago | (#33593602)

4K for 10 vulnerabilities is pretty low though. Find a critical vulnerability every 2 workdays and you might have a low-range tech salary.

Re:why are the bounties so low? (1)

adamdoyle (1665063) | more than 3 years ago | (#33595366)

4K for 10 vulnerabilities is pretty low though. Find a critical vulnerability every 2 workdays and you might have a low-range tech salary.

If we approximate "every 2 work days" to be "2 days a week" (which is being conservative), then we get:

(2 workdays / week) x (52 weeks / year) = (104 workdays / year) x ($4,000 / workday) = $416,000 / year

That's a low-range tech salary? Clearly I'm getting robbed...

Re:why are the bounties so low? (1)

adamdoyle (1665063) | more than 3 years ago | (#33595434)

I'm an idiot... disregard my above post (it was $400 per bug, not $4000). I need to learn to read.

Re:why are the bounties so low? (1)

n0-0p (325773) | more than 3 years ago | (#33599680)

It's not $400 per bug. Many of the bugs were discovered by Google employees, who don't get rewards. That pushes the average down. However, it also makes Google possibly the only company that appears to report all vulnerabilities they internally discover. MS doesn't report any internally discovered vulnerabilities, and even Mozilla will lump numerous internal discoveries under a single bug ID and CVE.

Re:why are the bounties so low? (2, Interesting)

DragonWriter (970822) | more than 3 years ago | (#33592852)

Surely Google could easily afford 10 (maybe even 100) times as much, and that would undoubtedly get a lot more people interested in looking.

Probably they are at the level that Google feels maximizes the cost:benefit ratio.

If they want to win the security war, they should be ramping up the bounties each release.

I'm not sure they view this as a "security war" that they need to "win", but even if it was, all they need to do is stay ahead of the competition. What are Mozilla, Microsoft, Apple, or Opera doing in this area that suggests that Google's bounties are too small?

Re:why are the bounties so low? (2, Interesting)

Surt (22457) | more than 3 years ago | (#33592918)

They certainly should view it as a security war, security has been the primary selling point for chrome from the beginning. If they aren't the best in this department, what would make anyone want to use chrome vs any of the other browsers that are superior in so many other ways?

And their competitors are paying comparable bounties. Google staying marginally ahead in bounties does not reassure me that they will keep their position.

Re:why are the bounties so low? (1)

Cinder6 (894572) | more than 3 years ago | (#33593104)

Superior is debatable. Everyone I know who uses Chrome (including myself) does so because they prefer it, not because of any added security features.

Re:why are the bounties so low? (3, Interesting)

DragonWriter (970822) | more than 3 years ago | (#33593340)

They certainly should view it as a security war, security has been the primary selling point for chrome from the beginning.

The primary selling point for Chrome, at the beginning, was JavaScript speed, which is why most of the promotional effort focussed on the V8 engine and its speed.

If they aren't the best in this department, what would make anyone want to use chrome vs any of the other browsers that are superior in so many other ways?

I don't think Google is all that concerned over whether or not Chrome is the leading browser. They don't sell Chrome.

They do care if common browsers behave in ways which make web content and services using open standards attractive to users, because Google's core business is indexing that kind of content, analyzing it, and selling advertising that leverages services built on top of services using the indexes built from that content.

Chrome is largely a tool to get other browser manufacturers to adopt features that make it attractive for content developers to use formats and protocols that are conducive to Google's business.

Re:why are the bounties so low? (0)

zach_the_lizard (1317619) | more than 3 years ago | (#33595028)

Chrome also gets advertisement for Google, considering it is Google branded and has Google search by default.

Re:why are the bounties so low? (1)

Toy G (533867) | more than 3 years ago | (#33598396)

Chrome is largely a tool to get other browser manufacturers to adopt features that make it attractive for content developers to use formats and protocols that are conducive to Google's business.

... and to enable Google's customers to use Google revenue-generating services (like GApps) if other browsers fail, which is why they also developed the IE engine replacement.

Re:why are the bounties so low? (1)

lavacano201014 (999580) | more than 3 years ago | (#33594926)

security has been the primary selling point for chrome from the beginning

The primary selling point to me for Chrome was Firefox took all of 90 seconds to load. I assume this is because it was doing something that I probably wanted it to do (like cache images for various websites I go to), but I got tired of waiting a minute and a half longer to check my email.

Re:why are the bounties so low? (1)

maxume (22995) | more than 3 years ago | (#33595162)

They are trying to increase the number of severe vulnerabilities that they close, not trying to reassure you that they will keep their position.

Re:why are the bounties so low? (3, Informative)

Sinistar2k (225578) | more than 3 years ago | (#33592926)

Mozilla pays $3K for critical security bugs.

http://www.mozilla.org/security/bug-bounty.html

Re:why are the bounties so low? (1, Redundant)

Surt (22457) | more than 3 years ago | (#33592986)

Part of my point was that Google sells Chrome as the 'secure' browser. They should put their money where their mouth is, instead of suggesting via these bounties that their browser is no better than Mozilla, which doesn't have the backing of a company with billions in profits.

Re:why are the bounties so low? (2, Insightful)

DragonWriter (970822) | more than 3 years ago | (#33593790)

Part of my point was that Google sells Chrome as the 'secure' browser.

The problem with that point is that it is wrong on a couple of levels.

First, Google doesn't sell Chrome, it gives it away free.

Second, Google promotes Chrome primarily as a fast, free, and simple browser. The main Chrome page [google.com] doesn't mention security at all. The Learn More [google.com] page linked from the main page lists security after speed and simplicity.

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33593922)

By sell, I mean convince people to use so that they can gather more statistics to sell to advertisers.

On the other point, it may well be that Google has given up on security as a main selling point, which would make for one substantially reduced reason to use it.

Re:why are the bounties so low? (1)

DragonWriter (970822) | more than 3 years ago | (#33594272)

On the other point, it may well be that Google has given up on security as a main selling point

Speed and simplicity and speed* were always the heavily promoted features of Chrome. Almost all of the launch publicity focussed on the V8 JavaScript engine and its speed, and the rest was mostly on the minimalist, get-out-of-the-way UI.

* Yes, I mean that exactly the way I wrote it.

Re:why are the bounties so low? (-1, Offtopic)

gmatrix24 (1901892) | more than 3 years ago | (#33593474)

Global Matrix Media dominates in the affiliate marketing space. We offer the highest payouts to our publishers and always pay on time. At the same time we offer the highest quality control and compliance for our advertisers to ensure that we deliver results to build and expand their business. Affiliate Network [globalmatrixmedia.com]

Re:why are the bounties so low? (-1)

Anonymous Coward | more than 3 years ago | (#33593608)

Get AIDS and die, you piece of walking shit.

Re:why are the bounties so low? (0)

Anonymous Coward | more than 3 years ago | (#33599730)

And Google pays $3113.70 for a critical vulnerability. The difference here is that a critical vulnerability on Chrome is code execution outside the sandbox, which is much rarer on Chrome than the equivalent on Firefox.

Re:why are the bounties so low? (2, Insightful)

rm999 (775449) | more than 3 years ago | (#33593382)

Chromium is a gift from Google: it is open source under a permissive license. The security of the product, and the prizes Google uses to maintain that security, are the icing on the free cake. We shouldn't complain about it.

Also, the fact that they are finding bugs means people are looking for them, so it seems they found a good price point. Perhaps the prestige of finding a bug in a major piece of software is worth more than 400 dollars.

Re:why are the bounties so low? (0)

Anonymous Coward | more than 3 years ago | (#33593950)

I can't believe there's somebody here on Slashdot saying that a company should "ramp up" its outsourcing. Because that's what this is. Instead of hiring internal QA to find these things, they pay dirt to thousands of faceless workers -- in fact, they pay these workers absolutely zero dollars unless they actually find something.

Why hire a local worker when you can outsource? And why pay somebody anything at all, when you can pay them nothing? Congrats Google, you've managed to snow somebody with a 5 digit user id on Slashdot.

Re:why are the bounties so low? (1)

Surt (22457) | more than 3 years ago | (#33599466)

LOL.

Print preview! One feature that I miss (1, Troll)

bogaboga (793279) | more than 3 years ago | (#33592704)

Tell me about Chrome when print preview is included. The trouble is that inclusion of this [basic] feature in Chrome will introduce yet another set of bugs. Scary! Come on Google.

Re:Print preview! One feature that I miss (1)

ickleberry (864871) | more than 3 years ago | (#33592726)

Because Google believes that printing is a sinful activity which is bad for the environment and that you should just share it through Google Docs and provide them with more data to mine?

Re:Print preview! One feature that I miss (1)

tepples (727027) | more than 3 years ago | (#33593070)

Because Google believes that printing is a sinful activity which is bad for the environment

So is rolling diesel trucks to install broadband everywhere, including currently unprofitable rural areas.

Re:Print preview! One feature that I miss (1)

geekoid (135745) | more than 3 years ago | (#33593324)

Depends.

If the broad band means people need to travel less, then it will probably be a gain.

Re:Print preview! One feature that I miss (2, Informative)

Yvan256 (722131) | more than 3 years ago | (#33593188)

With Mac OS X, you can print directly to a PDF file. And we don't need anything from Adobe to read those files either. From a user point of view, a PDF is no different than a PNG or a JPEG.

Re:Print preview! One feature that I miss (1)

geekoid (135745) | more than 3 years ago | (#33593334)

That's the same with Windows, and has been for years.

Re:Print preview! One feature that I miss (0)

Anonymous Coward | more than 3 years ago | (#33593422)

That's the same with Windows, and has been for years.

Yeah, but with a Mac, you don't need to install CutePDF to do it.

Re:Print preview! One feature that I miss (1)

Missing.Matter (1845576) | more than 3 years ago | (#33593688)

Look at what Microsoft had to do to get print to PDF working in Office. It was originally included by default, then became an optional download because Adobe had a problem with it. Imagine what kind of objections Adobe would raise if they integrated it into Windows.

Re:Print preview! One feature that I miss (2, Insightful)

knarf (34928) | more than 3 years ago | (#33593424)

With Linux, you can print directly to a PDF or PS file. And we don't need anything from Adobe to read those files either.

This has been possible for years and years and years, long before St. Jobs had the revelation which led him to base his OS on a unix.

Ghostscript - which enables you to do these things - was first released in 1986. Max OS X was first released in 2001...

Re:Print preview! One feature that I miss (1)

Stooshie (993666) | more than 3 years ago | (#33598334)

Bet you're glad that Adobe intentionally didn't patent publishing to a pdf format precisely in order to allow this kind of thing. That's real openness

Re:Print preview! One feature that I miss (1)

Yvan256 (722131) | more than 3 years ago | (#33599756)

Yes I'm glad. But then again we don't have idiots trying to make "PDF websites" like we have with Flash.

Re:Print preview! One feature that I miss (1)

DragonWriter (970822) | more than 3 years ago | (#33593274)

Because Google believes that printing is a sinful activity which is bad for the environment and that you should just share it through Google Docs and provide them with more data to mine?

Chrome supports printing, it just doesn't have print preview. While I miss it sometimes, web pages tend to be (even with the differences between paged and screen media) WYSIWYG enough that print preview isn't a big deal to me. Obviously, it is for some people though.

Re:Print preview! One feature that I miss (0)

Anonymous Coward | more than 3 years ago | (#33594080)

You can happily have it through an extension.
I'd rather not have my interface bogged up with useless crap i wouldn't use.

Same goes for those who want a "Send this" / "Email this" added. Possibly the worst feature ever to be included in a context menu.
"OH HEY, WANT TO SAVE THIS IMAGE? BETTER YET, LET'S EMAIL IT TO ALL YOUR MSN BUDDIES!"
So glad they haven't added it by default and instead allowed for people to add their own context menu items from extensions.

Thankless job indeed... (2, Insightful)

RobinEggs (1453925) | more than 3 years ago | (#33592716)

So a wealthy company internationally famous for its creative and lavish benefits to employees, a company with a share price of $480, paid a total of $4,000 to outsiders who informed them of 10 major bugs in their software? They paid out $400 per bug?

The bounty for finding and documenting a bug in a Google product isn't even enough to buy one share of Google stock? That's downright insulting

Re:Thankless job indeed... (0)

Anonymous Coward | more than 3 years ago | (#33592816)

The share price of a stock means nothing because it is based off the number of shares they decided to print off.

The market capitalization ($153 billion) is the number you want to throw around.

Re:Thankless job indeed... (1, Interesting)

Anonymous Coward | more than 3 years ago | (#33592902)

So a wealthy company internationally famous for its creative and lavish benefits to employees, a company with a share price of $480, paid a total of $4,000 to outsiders who informed them of 10 major bugs in their software? They paid out $400 per bug?

The bounty for finding and documenting a bug in a Google product isn't even enough to buy one share of Google stock? That's downright insulting

There really is no pleasing some people.

If Google executes a stock split, so that there are ten new shares for each old one, the price will change from $480 to $48. WIll that make you happy?

Re:Thankless job indeed... (3, Insightful)

zlogic (892404) | more than 3 years ago | (#33592908)

Chrome is an open source project, except that some of it is sponsored by Google. So hacking Gnome or the Linux kernel for free is OK (and by the way a lot of Linux kernel code was written by fulltime employees of Red Hat and other companies, just like Chrome) but fixing bugs for Chrome is not? Think of it as Google's Summer of Code, except on a smaller scale.

Is there an update feature? (1)

turkeyfish (950384) | more than 3 years ago | (#33596920)

With the bug fixes coming so quickly one after the other, Chrome needs an automatic update option to have it download and install new versions rather than requiring manual downloads. Is this in the works? Or have I missed something in the "Options" box?

Re:Is there an update feature? (1)

zlogic (892404) | more than 3 years ago | (#33597222)

Chrome updates automatically, this was a feature from the earliest 0.x beta versions. You can force an update check by opening the "About Chrome" window. However even though the update is downloaded and installed automatically, a restart of Chrome is required to actually use the newest version.

Re:Is there an update feature? (1)

simoncpu was here (1601629) | more than 3 years ago | (#33597238)

The Update Manager already does this for Ubuntu users...

Re:Thankless job indeed... (3, Informative)

DragonWriter (970822) | more than 3 years ago | (#33592910)

Thankless job indeed...

Um, I think you are confused.

People whose job it is to find bugs in Google software are Google employees. Their pay is not, I would assume, simply "by the bug", and I suspect that their pay is quite good.

Google happens to also give out bounties -- which many competitors don't -- as a kind of "thank you" to people who voluntarily report security bugs to Google. I'm not sure why you think that the standard for whether this is something nice or an "insult" is whether the bounty for the average bug is greater or less than the price of one share of Google stock.

Re:Thankless job indeed... (2, Insightful)

natehoy (1608657) | more than 3 years ago | (#33592952)

Personally, for FREE software, I'd be happy just to get the damned bug acknowledged and fixed in a jiffy, and maybe have my name in lights for doing the legwork. Any payment should be considered a rather nice bonus.

No matter how small or insulting it is, it's still 100% more than Microsoft pays for bug reports, and Microsoft's release schedule on the fixes is downright glacial compared to Google or Firefox. Assuming they don't outright ignore you or threaten to sue you for violating the EULA.

Which model is the most insulting again?

Re:Thankless job indeed... (1)

Achromatic1978 (916097) | more than 3 years ago | (#33593026)

No matter how small or insulting it is, it's still 100% more than Microsoft pays for bug reports, and Microsoft's release schedule on the fixes is downright glacial compared to Google or Firefox. Assuming they don't outright ignore you or threaten to sue you for violating the EULA.

Nice FUD. Microsoft issues patches monthly, and more frequently, out-of-band for critical security fixes.

Please, point to the last instance where MSFT threatened to sue for violating the EULA by reporting a bug in IE.

Go on, I'm waiting...

Borderline troll, I think.

Re:Thankless job indeed... (1)

Zero__Kelvin (151819) | more than 3 years ago | (#33593230)

"Nice FUD. Microsoft issues patches monthly, and more frequently, out-of-band for critical security fixes."

And also quite frequently they announce that they have no plans for fixing an important security flaw.

Please, point to the last instance where MSFT threatened to sue for violating the EULA by reporting a bug in IE.

That would be the last time someone clicked on the EULA, which was probably a few femtoseconds ago, no matter when you read this. The EULA explicitly forbids reverse engineering of their product(s). In order to effectively identify a bug you need to reverse engineer the software. Ergo, Microsoft is explicitly threatening that they might sue you if you identify and disclose a bug every time they ask (force?) you to click the EULA.

Re:Thankless job indeed... (3, Interesting)

Zero__Kelvin (151819) | more than 3 years ago | (#33593176)

"Personally, for FREE software, I'd be happy just to get the damned bug acknowledged and fixed in a jiffy, ...

By way of agreeing with you, I know that there are millions of people paying for software who pretty much never expect bugs to be fixed in a jiffy, and in fact have become completely complacent in accepting that many known security flaws have no plan for being fixed at all.

Or in other words:

Bounty paid by Google: $400.00
Bounty paid by Apple and Microsoft: $0.00 (i.e. it isn't even an option)

Re:Thankless job indeed... (1, Interesting)

Anonymous Coward | more than 3 years ago | (#33592964)

If you want to see if the reward is priced appropriately you should compare the hourly pay of a quality engineer to the amount of time it takes them to find a bug on average. How many shares of stock you can buy is as irrelevant as saying "it's not even enough to buy one macbook!".

Re:Thankless job indeed... (0)

Anonymous Coward | more than 3 years ago | (#33593020)

I believe the whole point of this is that they ARE thanking people - what they are doing for Google is not a job (in the sense that they are not a true employee of Google...minus Chris Evans, who actually works for Google), it is a hobby.

This is a positive thing that hopefully becomes a trend.

Re:Thankless job indeed... (2, Interesting)

melted (227442) | more than 3 years ago | (#33593050)

What "lavish" benefits are you talking about? Lunches? Lunches pay for themselves because they all of a sudden take 25-30 minutes instead of an hour or more. At $100+ (sometimes way more than that) per hour it just makes sense for a company to pay for lunches. Buses to and from work? Umm. OK, I'll give you that (even though Microsoft also has buses). On-site gym that hardly anyone goes to? What else?

Google is actually pretty bare bones on the inside. They hire three good engineers where other companies would hire 10 passable ones, and give them twice as much work. And yeah, they feed them, so that they'd have more time to do work.

Re:Thankless job indeed... (2, Informative)

Brian Quinlan (252202) | more than 3 years ago | (#33596786)

What "lavish" benefits are you talking about? Lunches? Lunches pay for themselves because they all of a sudden take 25-30 minutes instead of an hour or more. At $100+ (sometimes way more than that) per hour it just makes sense for a company to pay for lunches. Buses to and from work? Umm. OK, I'll give you that (even though Microsoft also has buses). On-site gym that hardly anyone goes to? What else?

  • Tuition reimbursement up to $12,000 per year.
  • Back-Up Child Care
  • Charity gift matching
  • Adoption assistance
  • On-site doctor (though dental seems more useful to me), oil change, games rooms, car wash, laundry, dry cleaning, massage, barber, fitness classes, bike repair, tech talks (by Barrack Obama, Randall Munroe, etc.)
  • Annual ski trip and other random trips e.g. one
  • 20% time (is that a benefit?)

Plus the usual as far as medical, dental, stock options, etc. And probably a bunch of other stuff that I don't know about.

Google is actually pretty bare bones on the inside.

Compared to?

Re:Thankless job indeed... (1)

Toy G (533867) | more than 3 years ago | (#33598552)

20% time (is that a benefit?)

That's not a benefit, because that 20% time must be employed on projects that will, indirectly or directly, eventually benefit Google itself. I.E. you can't just play with your Spaceballs dolls [youtube.com] .

Re:Thankless job indeed... (0)

Anonymous Coward | more than 3 years ago | (#33595892)

So a wealthy company internationally famous for its creative and lavish benefits to employees, a company with a share price of $480, paid a total of $4,000 to outsiders who informed them of 10 major bugs in their software? They paid out $400 per bug?

The bounty for finding and documenting a bug in a Google product isn't even enough to buy one share of Google stock? That's downright insulting

You bastard.

Re:Thankless job indeed... (0)

Anonymous Coward | more than 3 years ago | (#33596488)

And yet the $400 bounty has been enough to bring 10 security bugs to light.
If they paid $10k per bug would they have got a better result? If they did get more would they have been able to patch them all quick enough?

They want their bounty set at a level which brings in bugs at a rate they can handle, too fast and you have vulnerabilities leaking to the public quicker than they can be patched.
When they get no new bugs found, then it is time to step up the bounty to attract fresh and better hunters.

Re:Thankless job indeed... (0)

Anonymous Coward | more than 3 years ago | (#33598164)

You have incorrect pricing information: http://blog.chromium.org/2010/07/celebrating-six-months-of-chromium.html / http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html

      1. The maximum reward for a single bug has been increased to $3,133.7. We will most likely use this amout for SecSeverity-Critical bugs in Chromium. The increased reward reflects the fact that the sandbox makes it harder to find bugs of this severity.

      2. Whilst the base reward for less serious bugs remains at $500, the panel will consider rewarding more for high-quality bug reports. Factors indicating a high-quality bug report might include a careful test case reduction, an accurate analysis of root cause, or productive discussion towards resolution.

i'm glad this is happening (3, Interesting)

buddyglass (925859) | more than 3 years ago | (#33592762)

What I'd like to see next: Google pays bounty for bugs in other browsers (which it then forwards to those companies for repair).

This would be hilarious. You might think it'd be bad business (why should Google pay for bug finds that will benefit its competition?), but I think it'd be PR gold. Not to mention it would have the side effect of improving all-around security. (So Google could cast the new bounty as an altruistic gesture).

Re:i'm glad this is happening (1)

TheViciousOverWind (649139) | more than 3 years ago | (#33592866)

What are you smoking?
Not even Google have enough money for all that bugs in IE!

sliding scale! (1)

FranTaylor (164577) | more than 3 years ago | (#33593042)

$0.10 for an IE bug

$4000 for a Chrome bug

Re:sliding scale! (1)

TheViciousOverWind (649139) | more than 3 years ago | (#33593444)

What are you smoking?
Not even Google have enough money for all that bugs in IE!

Re:sliding scale! (1)

jimmypw (895344) | more than 3 years ago | (#33593528)

$.10 thats generous. Their two a penny!

Re:i'm glad this is happening (1)

thestudio_bob (894258) | more than 3 years ago | (#33592884)

You know, I was wondering if these bug fixes bleed over into Webkit, which Apple's Safari would not doubt benefit from. So maybe they are already doing something like this.

Re:i'm glad this is happening (1)

Yvan256 (722131) | more than 3 years ago | (#33593218)

Since Google uses Webkit which is from Apple, I think Apple kinda knew that these kinds of benefits could happen some day.

Re:i'm glad this is happening (1)

geekoid (135745) | more than 3 years ago | (#33593348)

I could start a browser company and write myself a Winnebago.

Re:i'm glad this is happening (1)

aBaldrich (1692238) | more than 3 years ago | (#33593762)

Well, google provides [techcrunch.com] over 80% of the Mozilla Foundation's funding, and Mozilla pays $3000 per bug [mozilla.org] , so effectively Google is paying bounties for other browsers.

How many people actually claimed the bounties. (1)

He who knows (1376995) | more than 3 years ago | (#33593024)

There is no mention of how many people claimed the bounties even if they were able to. I think some of the people simply reported the bugs when they found them and did not claim any money.

You get 3000$ per bug (0)

Anonymous Coward | more than 3 years ago | (#33593062)

Just so you know. Not only Google offers rewards.
Mozilla does the same:
http://www.mozilla.org/security/bug-bounty.html [mozilla.org]

mod dOwn (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#33593208)

Any parting shot, 0sers of NetBSD one Here but now p0lite to bring user. 'Now that don't be afraid

Oh joy... (1)

SanityInAnarchy (655584) | more than 3 years ago | (#33593394)

I'm glad some bugs were fixed, but it seems I now can't paste into Slashdot comment boxes. Chrome bug or Slashdot bug?

Re:Oh joy... (0)

Anonymous Coward | more than 3 years ago | (#33593580)

PEBKAC FTW ??

Re:Oh joy... (1)

SanityInAnarchy (655584) | more than 3 years ago | (#33595818)

...possibly? It seems to work now, at least. Maybe it was only on that page?

I did try ctrl+v, middle click, and right-click->paste. I even opened up the developer tools and manually changed the attribute. Nothing worked other than manually re-typing into the box.

Hello I am Prince of Ngiera (0)

Anonymous Coward | more than 3 years ago | (#33593448)

Being found bugs in browsers, found by I will pay more can Google. If wish money you do, forward 500 dollars american and bug to me.

Version Number Inflation? (0)

Anonymous Coward | more than 3 years ago | (#33593508)

Version 6.0 in how long? They'll be on version 100.0 by the time Firefox reaches version 5.0.

Scabbing (0, Troll)

stagg (1606187) | more than 3 years ago | (#33593512)

Bug bounties are really not far off from Scab work at all. Companies use bounties and contests to replace what could otherwise be lucrative positions for permanent employees. And as long as there are people out there willing to do the work for free, the company has no incentive to create those positions. They just paid 400$ a bug to get god knows how many people to run QA for them, and paid out the ten people that got in fresh, reproducible bugs the fastest. This is great for the companies running the contests, but it sure isn't good for workers or the industry.

Re:Scabbing (0)

Anonymous Coward | more than 3 years ago | (#33593574)

Um, Chrome's free.

Re:Scabbing (1)

totally bogus dude (1040246) | more than 3 years ago | (#33597056)

What's that got to do with anything? I'm pretty sure Google established a pretty compelling business case for releasing their own free web browser well before they committed resources to it.

Version Number (0)

Anonymous Coward | more than 3 years ago | (#33594440)

> Google Chrome 6.0.472.59

Please forgive my ignorance.
May some kind soul explicate the necessity/desirability of this version numbering scheme?

It's got more bugs that it lets on (0)

Anonymous Coward | more than 3 years ago | (#33596776)

Security bugs? I still can't get past the constant JavaScript and CSS error reports on almost every web page that I try. It seems that Google knows how to pontificate about how a web page should be designed but not how to load a page in its own browser... or should I say what was already a perfectly working web browser before they merely changed the branding and nobbled it!

'pushed out' (1)

hohokus (253713) | more than 3 years ago | (#33599270)

can we please stop using the phrase 'push out'? it conjures up an image of a turd every single time. of course, maybe that's the idea?
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>