Google is offering rewards as high as $3,133.70 for software updates that improve the security of OpenSSL, OpenSSH, BIND, and several other open-source packages that are critical to the stability of the Internet.
The program announced Wednesday expands on Google’s current bug-bounty program, which pays from $500 to $3,133.70 to people who privately report bugs found in the company’s software and Web properties. Security researchers inside the company considered modifying the program to reward bug reports in open-source software, but eventually decided against that approach. The reason: bug bounty programs often invite a flood of reports of varying quality that can overwhelm the finite resources of open-source developers. What’s more, it’s frequently much harder to patch a vulnerability than merely to find it.
Read more at ArsTechnica.
