They have to make it easy to report these problems, whether they give out cash or just put the person on a reward and maybe just give them free stuff...

I read once about a person that found a serious exploit, and tried to report it but it just got bounced around, and they had a hard time reporting it.

No one paid attention to the one person. The problem did not get fixed. 6 months later a virus was made and took down many computers. (I wish that I could remember which virus... grrr...)

I think that with open source there is an easy way to report bugs. They *want* you to find problems with it. They don't in Microsoft because the pointy haired boss wants the marketing people to be able to say "this is great software because it's closed and has professionals working on it".

The marketing people have to sell this as great, solid software that has been written without mistakes. You and I know that's impossible, but marketing monkey's don't understand that... they think that software engineering is Word macro's and "anyone can make a website" because they think that you just click "save as html". Ya, that's exactly what Yahoo! and eBay do.

Long story short, I think that in many cases the decision has been in the past a business one, not a software engineering one.

Oh for sure Jim. This kind of thing could happen under the regular consumer radar though, where the geeks live. Marketing departments and the general public don't care about under the radar but that's where you get geek respect for security, robustness and reliability ... then the geeks bug their bosses. Bottom up instead of top down == less resistence from the people maintaining the systems.

That sounds like a great idea, but I have two concerns.

First, in order to find bugs or vulnerabilities in the code, the code has to be available. This basically limits something like this to the open-source community. Unless we start to see a trend of companies paying developers to work on code, which they then make 'publicly viewable and usable, but not distributable' then I don't think this would take off.

Second, it's all fine to talk about restricting things to the 'Geek world', but the second you say 'bug' to a marketting person, they're not going to have any idea what it means (or how severe it is).
Take a look at whats happening with electronic voting in the states. The whole Diebold thing has been going on for close to a year, but its only recently that it's been getting decent coverage on CNN and the bigger american new sites.

There's also the problem of reporting. You wouldn't be able to just throw bugzilla on a server an let people submit bugs that way. You'd have to restrict everyone's access solely to the bugs that they're working on (otherwise the bug tracking software basically becomes a hands-on vulnerability guide).

Yeah, I pretty much meant no code access at all. You can still find defects with no code by punishing the software, ie. buffer overflows ...

As for the tracking, the first person to accurately report the defect would get the credit and the cash. The defect submission process would be private, of course, to give the company time to fix the bug before it's exploited.

This is a great idea! The frequency of public exploits to Microsoft software suggests that there are people out there who are discovering vulnerabilities and using their discoveries to get props the only way they can; assume a pseudonym and publish the 'sploit. With a 'bug bounty' in place there would be an alternative forum to take your exploits to which would get you recognition and cash.

That said, I would be curious to know what percentage of the recent exploits for Microsoft software were for vulnerabilities with existing patches. In other words, the exploit found in the wild was the result of translating Bugtraq (or similar) information into code or reverse engineering the existing patch. I suspect this is the common case, implying that finding the vulnerabilities is not the security bottleneck.