Mozilla Offers $10,000 Bount for Security Bug Cert Verification, Adds New Cert Verification Library to Gecko

Mozilla offers a $10,000 security bug bounty for Firefox 31 certificate verification currently scheduled to launch on July 31. Mozilla stated that they are principally interested in bugs that allow the construction of certificate chains which have been accepted as valid but should have been rejected, or anything in the code that leads to exploitable memory corruption. In general, if Firefox is unable to verify otherwise valid certificates, Mozilla does not consider this to be a security bug, but a bug that caused the browser to accept forged signed OCSP responses would definitely be. In regards to the updated library, the new implementation is now more maintainable, with only 4,167 lines of C++ code, compared to the previous 81,865 lines of code which had been auto-translated from Java to C. In addition, the new library benefits from C++ functionality such as memory cleanup tools. Read the full details here.

Mozilla makes a double announcement today, a $10k bug bounty and a new certificate verification library for their application web browser engine, Gecko.

View Article



Comments

  • There are no comments yet. Be the first to comment!

Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • At present, the most commonly deployed parallel file system is Lustre, and its adoption is growing across the HPC industry. According to Intersect 360 Research, "Through its leadership and involvement with OpenSFS, Cray advocates for the development of features that drive efficient performance at scale." Moreover, with help from Cray and OpenSFS, Lustre is gaining greater adoption across broader commercial application categories. As data and I/O requirements grow in commercial markets, technology vendors -- …

  • The 2014 State of DevOps Report — based on a survey of 9,200+ people in IT operations, software development and technology management roles in 110 countries — reveals: Companies with high-performing IT organizations are twice as likely to exceed their profitability, market share and productivity goals. IT performance improves with DevOps maturity, and strongly correlates with well-known DevOps practices. Job satisfaction is the No. 1 predictor of performance against organizational …

Most Popular Programming Stories

More for Developers

RSS Feeds

Thanks for your registration, follow us on our social networks to keep up-to-date