{"id":13568,"date":"2022-08-31T14:38:25","date_gmt":"2022-08-31T14:38:25","guid":{"rendered":"https:\/\/scienceandnerds.com\/2022\/08\/31\/googles-open-source-bug-bounty-aims-to-clamp-down-on-supply-chain-attacks\/"},"modified":"2022-08-31T14:38:26","modified_gmt":"2022-08-31T14:38:26","slug":"googles-open-source-bug-bounty-aims-to-clamp-down-on-supply-chain-attacks","status":"publish","type":"post","link":"https:\/\/scienceandnerds.com\/2022\/08\/31\/googles-open-source-bug-bounty-aims-to-clamp-down-on-supply-chain-attacks\/","title":{"rendered":"Google\u2019s open-source bug bounty aims to clamp down on supply chain attacks"},"content":{"rendered":"

Source: https:\/\/www.theverge.com\/2022\/8\/30\/23328977\/google-open-source-bug-bounty-supply-chain-hacks-dependencies<\/a>
\n
<\/br><\/code><\/p>\n

\n

Google has introduced a new vulnerability rewards program<\/a> to pay researchers who find security flaws in its open-source software or in the building blocks that its software is built on. It\u2019ll pay anywhere from $101 to $31,337 for information about bugs in projects like Angular, GoLang, and Fuchsia or for vulnerabilities in the third-party dependencies that are included in those projects\u2019 codebases.<\/p>\n

While it\u2019s important for Google to fix bugs in its own projects (and in the software that it uses to keep track of changes to its code, which the program also covers), perhaps the most interesting part is the bit about third-party dependencies. Programmers often use code from open-source projects so they don\u2019t continuously have to reinvent the same wheel. But since developers often directly import that code, as well as any updates to it, that introduces the possibility of supply chain attacks. That\u2019s when hackers don\u2019t target the code directly controlled by Google itself but go after these third-party dependencies instead.<\/p>\n

\n