@jwildeboer I disagree in parts.
Not everybody has the knowledge to propose a fix.
Reporting a bug in a way it can be reproduced is already a valuable contribution.
However, this goes together with expecting companies to contribute in some way.
Jun 22, 2025, 9:54 AM@morre Reporting a bug, getting handed out a bug bounty and then just throw the problem over the wall to the upstream maintainer is lazy and wrong, IMHO. The people that pay the bounty should be held responsible to come up with a fix. And compensate the upstream maintainer(s) if they demand a fix and working on it in secret until their embargo is lifted.
@jwildeboer From the first post in this thread I did not get your remarks were tightly related to bug bounties and embargo's on making vulnerabilities public. In that context I agree with you.
However, in general, I agree with @morre that good bug reports are very useful, also without a fix. But, people should not demand their bugs to be fixed.
Jun 22, 2025, 10:05 AM
@jwildeboer @morre What about tying the bug bounty amount to the completeness of the bug report?
If the fix is included and all tests are still green, the finder gets the full amount.
If there was an attempted fix but the tests failed, the finder and maintainer would share the bounty.
No fix at all? The maintainer gets the majority of the bounty.
Needless to say, there is a lot of fine print to consider. Also, this method might be exploitable, so it needs strong committee oversight and competent handling. However, it might be a good starting point.
Jun 22, 2025, 12:24 PM@cure53 @jwildeboer @morre IMHO creating the fix is not the big chunk of the work for a bounty program. It is all the assessing, researching, understanding and back and forthing before the issue is confirmed and verified etc. Once that is done, the fix itself is often quite straight forward.
Jun 22, 2025, 12:25 PM@cure53 @jwildeboer @morre which also is done for lots of reports that end up not a security problem at all, thus not giving anyone any money...
@bagder True, we are lucky with our - in that regard - niche software because either the JavaScript alert pops or it doesn't, and if it doesn't, well - likely no bug.
But in other projects, that phase certainly demands for way more time than the actual fix/patch itself.
Likely complicated to address without aforementioned committee or any other competent entity accompanying the whole triaging process.
@bagder @cure53 @jwildeboer that’s a very good point.
For the software I maintain, I’d estimate that about 10% of time is writing the fix, while probably about 80% is understanding the issue - which mostly tells me what the fix is.
Is this Pareto at work again?
@jwildeboer Getting bounties for reporting is all wrong in my opinion, tbh.