Mozilla Offers $10,000 Bount for Security Bug Cert Verification, Adds New Cert Verification Library to Gecko

Mozilla offers a $10,000 security bug bounty for Firefox 31 certificate verification currently scheduled to launch on July 31. Mozilla stated that they are principally interested in bugs that allow the construction of certificate chains which have been accepted as valid but should have been rejected, or anything in the code that leads to exploitable memory corruption. In general, if Firefox is unable to verify otherwise valid certificates, Mozilla does not consider this to be a security bug, but a bug that caused the browser to accept forged signed OCSP responses would definitely be. In regards to the updated library, the new implementation is now more maintainable, with only 4,167 lines of C++ code, compared to the previous 81,865 lines of code which had been auto-translated from Java to C. In addition, the new library benefits from C++ functionality such as memory cleanup tools. Read the full details here.

Mozilla makes a double announcement today, a $10k bug bounty and a new certificate verification library for their application web browser engine, Gecko.

View Article



Comments

  • There are no comments yet. Be the first to comment!

Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • Live Event Date: December 11, 2014 @ 1:00 p.m. ET / 10:00 a.m. PT Market pressures to move more quickly and develop innovative applications are forcing organizations to rethink how they develop and release applications. The combination of public clouds and physical back-end infrastructures are a means to get applications out faster. However, these hybrid solutions complicate DevOps adoption, with application delivery pipelines that span across complex hybrid cloud and non-cloud environments. Check out this …

  • Relying on outside companies to manage your network and server environments for your business and applications to meet the needs and demands of your users can be stressful. This is especially true as many Managed Hosting organizations fail to meet their service level agreements. Read this Forrester total economic impact report and learn what makes INetU different and how they exceed their customers' managed hosting expectations.

Most Popular Programming Stories

More for Developers

RSS Feeds