Bugs are an unpleasant fact of life for browser-makers -- but Google is proving just how serious it is about getting to the root of them. Google on Thursday launched a new Chromium Vulnerability Rewards Program to encourage bug hunters to report open doors in its open source browser.
With the new program, Google is essentially upping the ante for security researchers who invest their time to make Chromium more secure  . Google so far has paid out more than $1 million in rewards to security researchers but software engineer Chris Evans said there's been a drop off in reports recently.
"This signals to us that bugs are becoming harder to find, as the efforts of the wider community have made Chromium significantly stronger," Evans wrote in a blog post. Google figures harder-to-find bugs demand higher-than-usual rewards and is responding accordingly.
Big Bounty Bonuses
Under the new Chromium Vulnerability Rewards Program paradigm, Google is adding a bonus of $1,000 or more on top of the base reward for what it calls "particularly exploitable" issues.
"The onus is on the reporter to provide a quick demonstration as part of the repro," Evans explained. "For example, for a DOM-based use-after-free, one might use JavaScript to allocate a specific object type in the 'freed' slot, resulting in a vtable dereference of 0x41414141."
Google is also adding a bonus of $1,000 or more on top of the base reward for bugs in stable areas of the code base. By "stable," Evans said, Google means that the defect rate appears to be low. Google is also adding a bonus of $1,000 or more on top of the base reward for serious bugs that impact a significantly wider range of products beyond Chromium.
What does Google mean by over "$1,000 or more on top of the base reward"? Google can decide that on a case-by-case basis. Some rewards have reached as high as $10,000.
Beyond Google Chrome
But Google isn't stopping with Chrome. The Chromium Vulnerability Rewards Program continues to cover vulnerabilities in Adobe Flash as well as other well-known software such as the Linux kernel, various open-source libraries and daemons, X windows, and so on.
We caught up with Greg Sterling to get his take on the changes Google is making to its Chromium Vulnerability Rewards Program. He told us this move highlights Google's obvious interest in identifying and fixing security flaws.
"Crowd sourcing that function, as many companies are doing, is very smart and more effective than leaving it up to an internal team," Sterling said. "By raising the bounties it pays it will get more attention and time from hackers and others. There's a competitive market for their time and Google is competing with others."
Based on your interest in this article, here's something that may be of interest to you also:
This article relates to the following term(s) that also match our recommendation: Google. ( Close)
 Recommended Reading: Search & Destroy: Why You Can't Trust Google Inc. Synopsis: This is the other side of the Google story. In Search & Destroy, Google expert Scott Cleland, shows that the world's most powerful company is not who it pretends to be.
Google pretends to be a harmless lamb, but chose a full-size model of a Tyrannosaurus Rex as its mascot. Beware the T-Rex in sheep's clothing.
|
NewsFactor.com 
Syrian Electronic Army Hacks Financial Times 
Patch Tuesday Hyper Focuses on IE 8
Surge of Venture Capital Buoys Tech Security Sector 
U.S. Defense Department Gives iOS 6 Security OK
Cisco Surges After Profit Exceeds Analysts' Estimates 
HP and SAP Team To Advance HANA Database Technology
What's in Store for Apple's iOS 7?
Google Glass Raises Congressional Privacy Concerns
Windows Phone Now No. 3 in Market, BlackBerry No. 4
U.S. Could Use Cyberattack on Syrian Air Defenses
Cloud Computing Gains Another Competitor with Google