Language Selection

English French German Italian Portuguese Spanish

Mozilla seeks security researchers to look at alpha code

Filed under

Mozilla Corporation wants to get the security community involved in ironing out possible bugs with the next version of Firefox at an earlier stage.

Instead of pointing out security bugs once Firefox 3.0 gets released, Mozilla wants security vendors involved while the software in still a work in progress.

Window Snyder, the "chief security something" or head of security strategy at Mozilla Corporation, explained: "We want to encourage the security community to get involved earlier, at the design and implementation stage. There's a wealth of information we can share."

Mozilla has run a security bug bounty program offering $500 as a thank you to researchers who unearth security bugs since 2004. In addition to this, commercial vendors send in bugs as they are discovered. A team of around 70 volunteers in the Mozilla development community perform triage and work on the development of security fixes.

Full Story.


Also: Linux community attempts to sponsor Indy 500 car ( tux500 )

More in Tux Machines

Today in Techrights

A few thoughts on OpenBSD 5.8

I've been using OpenBSD since way back at release 2.3 in 1998, so I've gone through upgrades that took a fair amount of work due to incompatible changes, like the switch from ipf to pf for host firewalling or the change to ELF binaries. The upgrade from 5.7 to 5.8 was a pretty smooth and easy one, for the most part. The two most painful changes for me were the replacement of sudo with doas and the dropping of support in the rc.conf for the pf_rules variable. While sudo is still available as a package, I like the idea of reducing attack surface with a simpler program, so I made the switch. The two things I miss most about sudo are the ability to authenticate for a period of time and the ability to have a single config file across a whole set of servers. The former I'm just living with, the latter I've adjusted to by having a single config file that has lines commented out depending on which server it's on. I did have one moment of concern about the quality of doas when it incorrectly reported the line number on which I had a syntax error in the config file--fortunately, this was just a failure to increment the line count on continuation lines (ending with a "\") which is fixed in the -current release. Read more

10 recently open-sourced products from big tech companies

Releasing internal products to the open-source community is the hip new thing for technology giants to do Read more