News

As Devs Code .NET Core, Microsoft Offers Bug Bounty

As developers churn through coding the next versions of .NET Core and other key Microsoft technologies, the company offers new bounties on bugs. Program runs to September.

As the community of developers churning through open sourced versions of the upcoming .NET Core 1.0, ASP.NET Core 1.0 and other key Microsoft technologies, there's bound to be some bugginess to the code. With that, Microsoft is offering a window of opportunity for developers to cash in on discovering bugs with a three-month bug bounty program.

There's actually a number of bug bounty programs being offered by Microsoft, including ones for those discovering bugs with Office 365 and Azure that are ongoing, but most relevant to developers are the ones for .NET Core and ASP.NET Core.

According to a new post on Microsoft's Security TechCenter, the bounty program runs from June 7 to September 7, and is worth $500 to $15,000 if developers submit a discovered vulnerability within .NET Core and ASP.NET Core R2 and other releases that are made available within the next three months.

Developers who want to get a payout for bugs must submit the bug using the Coordinated Vulnerability Disclosure guidelines, and the bug must be original, so timing is key in submissions (as other developers might be discovering the same or similar bugs).

Much of the information on submission and criteria and qualification of bug submissions is on the Program Terms page here. In a nutshell, any submitted vulnerability has to be original and a flaw that hasn't shown up in any vulnerability reports, and the flaw has to be well documented so that Microsoft's security researchers can reproduce the flaw as a proof of concept. Examples of qualified submissions are "bypasses of CSRF protection, Encoding, Data Protection failures, Information disclosures to a client, Authentication bypasses and Remote Code Execution," notes the Program Terms, and must come with exacting steps for reproducing the flaw.

Specific payouts and steps for submitting bugs to the bounty program are available on the Program Terms page in the TechNet Security Center site.

About the Author

Michael Domingo is a long-time software publishing veteran, having started up and managed several developer publications for the Clipper compiler, Microsoft Access, and Visual Basic. He's also managed IT pubs for 1105 Media, including Microsoft Certified Professional Magazine and Virtualization Review before landing his current gig as Visual Studio Magazine Editor in Chief. Besides his publishing life, he's a professional photographer, whose work can be found by Googling domingophoto.

comments powered by Disqus

Featured

  • Here's a One-Stop Shop for .NET 5 Improvements

    Culled from reams of Microsoft documentation, here's a high-level summary of what's new for performance, networking, diagnostics and more, along with links to the nitty-gritty details for those wanting to dig in more.

  • Azure SQL Database Ranked Among Top 3 Databases of 2020

    Microsoft touted the inclusion of Azure SQL Database among the top three databases of 2020 in a popularity ranking by DB-Engines, which collects and manages information about database management systems, updating its lists monthly.

  • Time Tracker Says VS Code Is No. 1 Editor for Devs, Some Working 15+ Hours Per Day

    WakaTime, which does time tracking for programmers, released data for 2020 showing that Visual Studio Code is by far the top editor/IDE used by its coders, some of whom are hacking away for more than 15 hours per day.

  • VS Code Java Project Explorer Gets Better

    The recently introduced project view for managing Java projects in Visual Studio Code received several enhancements in the latest update to Java functionality provided in Microsoft's popular open source, cross-platform code editor.

Upcoming Events