Google's Native Client Vulnerability Contest

[hat tip: Ryan Naraine]

Google has decided to have a bugfinding contest for its Native Client. After its Borg-like introduction of the "Android Security Team" (no names, collective only), it also introduced the contest.

For vendors, this is probably the best option to take to address public vulnerability disclosure. The idea is to increase the value to researchers in order to focus efforts and presumably find most of the security bugs, rather than the traditional alternative of submitting to random public bugfinding.

I wrote a post back in 2005 that mentioned this option:

Of course, we don't live in that perfect world. We live in a world where random people look for random vulnerabilities in random applications. Randomness is kiling us. In this world, the best thing to do is to create a set period of time and have a contest, real or implied. Get everyone focused on one platform, perhaps by offering a reward (from the manufacturer, not this ridiculous stuff by third parties).

It will be interesting to see if the vulnerability discovery curve for Android is significantly different from other solutions. (It would also be great to determine rediscovery rates for vulnerabilities).

Corrected [2/27/09]: Fixed per Ryan's clarification in the comments.

Comments

[Ryan Naraine]

Thanks for the pickup Pete. Small correction: It's for Native Client, not Android.

_r

[buy propecia]

How do you add google adsense ads to your youtube video page?
How do you add google adsense text links to your youtube video page? I understand the google video units are just attached to the video itself, but how can you add the actual google text links to the page also?