Jun 22, 2025, 9:48 AMAnd no, money doesn't help. When companies like Google and Apple pay bug bounties but don't send a fix upstream and instead demand that the maintainers fix stuff for free but have to respect their arbitrary embargoes, meaning working in secret — that is wrong on so many levels.
If you find a bug, propose a fix. If you don't propose a fix, no bounty. And every bounty paid out should result in the same sum sent to the upstream project. That would be a good start.
2/3
Jun 22, 2025, 10:03 AMWhen we had the xz issue last year, I proposed a solution to help upstream maintainers by giving them access to paid experts. A kind of reverse 0day approach. Maybe it's time to look at it again.
And to make this perfectly clear: This is my personal opinion, based on my years of experience in the FOSS galaxy.
3/3
Jun 22, 2025, 11:22 AMAddendum: Again, IMHO (In My Humble Opinion), Nick Wellnhofer made the right decision here. I fully understand his frustration about effectively being forced to work under stress to come up with a fix and getting nothing in return.
He is also giving her maintainers from other projects a well-thought out set of arguments to do the same. Before the burnout comes knocking.
@jwildeboer I disagree in parts.
Not everybody has the knowledge to propose a fix.
Reporting a bug in a way it can be reproduced is already a valuable contribution.
However, this goes together with expecting companies to contribute in some way.
Jun 22, 2025, 9:54 AM@morre Reporting a bug, getting handed out a bug bounty and then just throw the problem over the wall to the upstream maintainer is lazy and wrong, IMHO. The people that pay the bounty should be held responsible to come up with a fix. And compensate the upstream maintainer(s) if they demand a fix and working on it in secret until their embargo is lifted.
@jwildeboer From the first post in this thread I did not get your remarks were tightly related to bug bounties and embargo's on making vulnerabilities public. In that context I agree with you.
However, in general, I agree with @morre that good bug reports are very useful, also without a fix. But, people should not demand their bugs to be fixed.
Jun 22, 2025, 10:05 AM
@jwildeboer @morre What about tying the bug bounty amount to the completeness of the bug report?
If the fix is included and all tests are still green, the finder gets the full amount.
If there was an attempted fix but the tests failed, the finder and maintainer would share the bounty.
No fix at all? The maintainer gets the majority of the bounty.
Needless to say, there is a lot of fine print to consider. Also, this method might be exploitable, so it needs strong committee oversight and competent handling. However, it might be a good starting point.
Jun 22, 2025, 12:24 PM@cure53 @jwildeboer @morre IMHO creating the fix is not the big chunk of the work for a bounty program. It is all the assessing, researching, understanding and back and forthing before the issue is confirmed and verified etc. Once that is done, the fix itself is often quite straight forward.
Jun 22, 2025, 12:25 PM@cure53 @jwildeboer @morre which also is done for lots of reports that end up not a security problem at all, thus not giving anyone any money...
@bagder True, we are lucky with our - in that regard - niche software because either the JavaScript alert pops or it doesn't, and if it doesn't, well - likely no bug.
But in other projects, that phase certainly demands for way more time than the actual fix/patch itself.
Likely complicated to address without aforementioned committee or any other competent entity accompanying the whole triaging process.
@bagder @cure53 @jwildeboer that’s a very good point.
For the software I maintain, I’d estimate that about 10% of time is writing the fix, while probably about 80% is understanding the issue - which mostly tells me what the fix is.
Is this Pareto at work again?
@jwildeboer Getting bounties for reporting is all wrong in my opinion, tbh.
@jwildeboer
Thank you for sharing this. From my POV this is what the EU Commission is trying to fix with the CRA. Manufacturers are responsible for everything they put into a product. They have to fix the sec vuln and have to upstream fixes if they use OSS
If it works, time will tell.
Jun 22, 2025, 1:10 PM@jwildeboer essentially, OSS is a common good. That means everyone profiting from it must put some work in maintaining it. This is just like a shared meadow in a village. All farmers have to do upkeep in order that their cows can be there. This includes also the big farmers. The same should apply here. So Google can easily pay a couple of people to support maintenance of the library, so can M$.
@jwildeboer yeah, while businesses are limited to money as the only true expression of value, open source has always held up participation as an expression of the same. Money is one of many tools to achieve greater participation, and is nearly worthless when it doesn’t lead to more participation.
@jwildeboer tbh, companies (esp. the very big ones) should just stop being freeloaders and actually have internal staff doing reviews and testing. And for each bug (or security issue encountered) actually propose a fix upstream.
If your ROI or even just internal processes depend upon some open source project you should have at leat one developer reviewing that projects changes and stay in touch with that projects community AND also contribute hardening and security audits+fixes...
@jwildeboer I think the @sovtechfund has a program like that: https://www.sovereign.tech/programs/bug-resilience#how-to-apply
@jwildeboer Proposing a fix often requires a level of understanding that bug-discovery doesn't require... 😐
A bad fix is often worse than no fix at all.
But worst of all, of course, is that we don't find the bug, our customers do.
Hey ho. That's what software is all about, I s'pose? 😉
Jun 22, 2025, 10:41 AM@PatternChaser Open Source has no customers. There is no business relationship. If the bug is in your product (and you use open source libraries), it is now your responsibility to fix it. You can ask upstream to help, but there is zero obligation of upstream to do that.
Which is why, IMHO, it is crucial to have good relationships with upstream. To offer them help, if needed, instead of demands, embargoes and deadlines.
Jun 22, 2025, 10:39 AMI like the idea of "same sum sent to the upstream project".
I also wonder how often we would hear "it was introduced in upstream so why we have to pay them".
Also reporting bugs without fix is important. Some issues can be found and reproduced without understanding code of a project.
Jun 22, 2025, 12:39 PM@jwildeboer Or even something like: find an issue, get a small bounty, provide a fix with docs, working CI and whatnot: full bounty
And yes, current model sucks quite a lot