2015年6月26日 星期五

Hackers Paid to Do Right Thing/賞金誘人 付錢讓駭客出對的任務


【men's uno電子報】提供流行穿搭、單品介紹等內容,讓你輕鬆掌握流行時尚訊息,成為最具魅力的時尚質男! 【跟我學日語—高級報】每週文章介紹日本相關資訊,讓你不僅可認識日本,更可藉由閱讀文章來加深日文程度。
無法正常瀏覽圖片,請按這裡看說明   無法正常瀏覽內容,請按這裡線上閱讀
新聞  健康  財經  追星  NBA台灣  udn部落格  udnTV  讀書吧  
讀紐時學英文
2015/06/26 第78期 訂閱/退訂看歷史報份
 
 
紐時周報精選 Hackers Paid to Do Right Thing/賞金誘人 付錢讓駭客出對的任務
Real Jobs From Fake Businesses/虛擬公司真工作 法國職訓網發假薪水也搞假罷工
紐時周報精選
 
Hackers Paid to Do Right Thing/賞金誘人 付錢讓駭客出對的任務
王麗娟/譯
In 2011, two Dutch hackers in their early 20s made a target list of 100 high-tech companies they would try to hack. Soon, they had found security vulnerabilities in Facebook, Google, Apple, Microsoft, Twitter and 95 other companies' systems. They called their list the Hack 100.

2011年,兩名20出頭的荷蘭駭客列出100家高科技公司,作為嘗試駭入的目標。他們很快便發現臉書、谷歌、蘋果、微軟、推特和另外95家公司系統的漏洞。他們稱這張清單為「100駭」。

When they alerted executives of those companies, about a third ignored them. Another third thanked them, curtly, but never fixed the flaws, while the rest raced to solve their issues. Thankfully for the young hackers, no one called the police.

他們警告這些公司的高管時,約三分之一的人置若罔聞。另有三分之一言謝卻未補漏。剩下的三分之一則趕忙解決問題。這兩位駭客運氣不錯,沒有人報警。

Now the duo, Michiel Prins and Jobert Abma, are among the four co-founders of a San Francisco tech start-up that aims to become a mediator between companies with cybersecurity issues and hackers like them who are looking to solve problems rather than cause them.

這個雙人拍檔,米歇爾.普林斯和喬貝.阿布馬,現在是舊金山一家新創科技公司四位創辦人中的兩人。公司意在有網路安全問題的企業與駭客間充當中人,這些駭客和他們一樣,只想解決而非製造問題。

They hope their outfit, called HackerOne, can persuade other hackers to report security flaws, rather than exploit them, and connect hackers with companies willing to pay a bounty for their finds.

他們希望他們的公司「駭客一號」能說服其他駭客通報安全漏洞,而不利用漏洞惡搞,並幫願支付發現漏洞賞金的公司與駭客牽線。

圖擷自HackerOne

In the last year, the start-up has persuaded some of the biggest names in tech – including Yahoo, Square and Twitter – and companies you might never expect, like banks and oil companies, to work with their service. They have also convinced venture capitalists that, HackerOne has the potential to be very lucrative. HackerOne gets a 20 percent commission on top of each bounty paid through its service.

一年來,這家新創公司已說服雅虎、廣場.推特之屬科技界大咖,以及銀行、石油業者等你絕對想像不到的一些公司,採用他們提供的服務。他們還說服創投公司「駭客一號」具有賺大錢的潛力。「駭客一號」從媒介成功的每筆獎金抽佣二成。

"Every company is going to do this," said Bill Gurley, a partner at Benchmark, which invested $9 million in HackerOne. "To not try this is brain-dead."

「基準」公司投資900萬美元於「駭客一號」,合夥人之一比爾.格利說:「每家公司都會需要這種服務。不這麼做,就是腦死。」

Hackers who find new holes in corporate systems can, depending on their severity, expect six-figure sums to sell their discovery to criminals or governments, where those vulnerabilities are stockpiled in cyberarsenals and often never fixed. Alternatively, when they pass the weaknesses to companies to get them fixed, they are ignored or threatened with jail.

駭客在企業系統內找到漏洞時,將他們的發現賣給罪犯或政府,漏洞嚴重時可獲六位數的賞金,這些漏洞積存在政府的網路武器庫而且往往從未修補。或者,他們會將這些漏洞告知公司,希望他們修漏,但對方可能相應不理,或揚言讓他們吃牢飯。

"We want to make it easy and rewarding for that next group of skilled hackers to have a viable career staying in defense," said Katie Moussouris, HackerOne's chief policy officer, who pioneered the bounty program at Microsoft. "Right now, we're on the fence."

「駭客一號」政策長凱蒂.穆蘇里斯說:「我們希望讓未來一群高竿駭客能以(網路)守衛為業,順利且有足夠回報。」穆蘇里斯協助微軟首創賞金計畫,她說:「現在,我們還沒搞定。」

Mr. Prins and Mr. Abma started HackerOne with Merijn Terheggen, a Dutch entrepreneur living in Silicon Valley. The three met their fourth co-founder through the Hack 100 effort when they sent an email alerting Sheryl Sandberg, Facebook's chief operating officer, of a vulnerability in Facebook's systems. Ms. Sandberg didn't just thank them, she printed out their message, handed it to Alex Rice, Facebook's product security guru at the time, and told him to fix it. Mr. Rice worked with them to fix the issue, paid them a $4,000 bounty and joined them a year later.

普林斯、阿布馬與住在矽谷的荷蘭企業家梅莉珍.特赫根一起創辦「駭客一號」。三人在完成「100駭」的過程中遇到第四位共同創辦人。當時他們寫了一封電郵給臉書營運長雪柔.桑德伯格,告以臉書的一個漏洞。桑德伯格不僅致謝,還印出他們的訊息交給當時的臉書產品安全大師亞歷克斯.賴斯,要他解決問題。賴斯和他們一起補漏,付給他們4000美元賞金,更在一年後加入了他們。

Tech companies began rewarding hackers five years ago when Google started paying hackers $3,133.70 for bugs (31337 is hacker code for "elite"). Since then, Google has paid as much as $150,000 for a single bounty and doled out more than $4 million to hackers. Mr. Rice and Ms. Moussouris helped pioneer the bounty programs at Facebook and Microsoft.

高科技公司5年前開始獎賞駭客,谷歌開始時,每一漏洞支付3133.70美元(31337在駭客代碼中意為「精英」)。其後,谷歌付出的單筆最高獎金是15萬美元,且迄今已支付駭客逾400萬美元。賴斯和穆蘇里斯協助臉書和微軟創設了賞金計畫。

"A lot of companies have hackers – they just don't know it," Mr. Terheggen said. "The bad guys are on there already. The good guys don't show up unless you invite them."

特赫根說:「很多公司都有駭客,只是他們不知道。壞人已在那裡。好人不會出現,除非你邀請他們。」

About 1,500 hackers are on HackerOne's platform. They have fixed around 9,000 bugs and received more than $3 million in bounties.

「駭客一號」平台約有1500駭客,共已修漏約9000處,領賞約300萬美元。

HackerOne competes with the bounty programs its founders helped start at Facebook, Microsoft and Google. HackerOne also competes with Bugcrowd, a similar start-up that charges companies an annual fee to manage their programs. Bugcrowd works with young companies like Pinterest and institutions like Western Union.

「駭客一號」和他們創辦人協助臉書、微軟和谷歌設置的獎金計畫一起競爭客戶。「駭客一號」也和「蟲群」競爭,這家新興公司以收取年費方式替企業管理程式。「蟲群」的合作對象包括年輕公司如新社群媒體 Pinterest,以及「西聯匯款」這類的機構。

"Every technology has vulnerabilities, and if you don't have a public process for responsible hackers to report them, you are only going to find out about them through attacks in the black market," Mr. Rice said. "That is just unacceptable."

賴斯說:「每一種技術都有弱點,若沒有一個公眾參與機制可讓駭客舉報漏洞,你只能透過黑市攻擊發現這些漏洞,這是令人無法接受的。」

 
Real Jobs From Fake Businesses/虛擬公司真工作 法國職訓網發假薪水也搞假罷工
田思怡/譯
At 9:30 a.m. one weekday, the phones at Candelia, a purveyor of sleek office furniture in Lille, France, rang steadily with orders from customers across the country and from Switzerland and Germany. A dozen workers processed sales, dealt with suppliers and arranged for desks and chairs to be shipped.

一個上班日的早上9點半,法國里爾市的時尚辦公室家具經銷商Candelia公司電話響個不停,是來自法國全國各地,以及瑞士和德國客戶的訂單。十幾名員工處理銷售業務、接洽供應商,並安排運送桌椅。

Sabine de Buyzer leaned into her computer and scanned a row of numbers. Candelia was doing well. "We have to be profitable," she said. "Everyone's working all out to make sure we succeed."

薩賓娜.德畢澤靠向她的電腦,掃描一排數字。Candelia生意很好。她說:「我們必須賺錢。每個人都拚全力工作,確保我們成功。」

This was a sentiment any boss would like to hear, but in this case the entire business is fake. So are Candelia's customers and suppliers. Even the bank where Candelia gets its loans is not real.

這是所有老闆求之不得的工作氣氛,但這個案例是,整個生意都是假的。Candelia的客戶和供應商也是假的。連貸款給Candelia的銀行也不存在。

And there are thousands more fake businesses like this across Europe. These companies are all part of an elaborate training network that effectively operates as a parallel economic universe. For years, the aim was to train students and unemployed workers looking to make a transition to different industries. Now they are being used to combat the alarming rise in long-term unemployment, one of Europe's most pressing problems.

而在全歐洲,有數以千計這樣的假商家。這些公司都屬於一個精心設計的訓練網,如同一個並行的經濟體般有效運作。多年來,假公司的目標是訓練學生,以及想轉到不同產業的失業員工。現在這些假公司被用來對抗令人憂心的長期失業人口上升,這也是歐洲最迫切的問題之一。

圖擷自Inform Foundation

Ms. de Buyzer, 41, lost her job as a secretary two years ago and has been unable to find steady work. Since January, though, she arrives by 9 a.m. at the small office in a low-income neighborhood of Lille, where joblessness is among the highest in the country.

41歲的德畢澤兩年前丟掉秘書工作,之後一直找不到穩定的工作。不過,自今年1月開始,她早上9點之前抵達里爾市低收入區的一間小辦公室,里爾市的失業率是全法國最高的。

"It's been very difficult to find a job," said Ms. de Buyzer, who like most of the trainees has been collecting unemployment benefits. "When you look for a long time and don't find anything, it's so hard. You can get depressed," she said. "I just want to work."

德畢澤說:「找工作一直很困難。」她就像大部分接受職業訓練的學員一樣,領失業津貼。她說:「當你找了很長一段時間,什麼差事也沒找到,真的很不好受。你會很沮喪,我只是想要工作。」

Five years after Europe descended into crisis, there are signs that a recovery may finally be taking hold. Yet long-term unemployment – the kind that Ms. de Buyzer and nearly 10 million others in the eurozone are experiencing – has become a defining reality. Last year, a staggering 52.6 percent of unemployed people in the eurozone were without work for a year or more, the highest on record, according to the statistical agency Eurostat.

在歐洲陷入危機的5年後,有跡象顯示復甦也許終於穩住了。但長期的失業-類似德畢澤和歐元區其他近一千萬人的遭遇-已成為清楚的現實。根據統計機關「歐盟統計局」的資料,去年,歐元區失業人口中,至少已失業一年者高達百分之五十二點六,比率驚人,是有紀錄以來最高的。

"If you have a significant part of the population that's not integrated, they won't increase their spending, which dampens a possible recovery," said Paul de Grauwe, of the London School of Economics.

倫敦政經學院的保羅.德格羅韋說:「人口中若有相當一部分人被排除在外,他們不會增加支出,削弱了可能的復甦。」

The concept of virtual companies, also known as practice firms, traces its roots to Germany after World War II, when large numbers of people needed to reorient their skills. Intended to supplement vocational training, the centers spread rapidly in the last two decades. Today about 5,000 practice firms operate on the Continent, supported by government funds, with at least 2,500 elsewhere in the world.

虛擬公司也稱為練習公司,這個觀念可追溯到二次大戰後的德國,當時有為數眾多的人需要學習新的職業技能。這些中心的用意是輔助職業訓練,在過去廿年快速擴展。今天,大約有5000家由政府經費支持的練習公司在歐洲大陸營運,全球其他地方至少還有2500家。

Within France, 12 new centers have sprung up since 2013, said Pierre Troton of Euro Ent'Ent, which oversees the nation's network of 110 virtual companies.

監管全法國110家虛擬公司網絡的Euro Ent'Ent機構的皮耶.特侯頓說,自2013年以來法國出現了12個新中心。

In the companies, workers rotate through payroll, accounting and other departments. They receive virtual salaries to spend in the make-believe economy.

在這些公司內,員工輪流在薪資、會計和其他部門工作。他們拿虛擬薪水,在虛構的經濟體內花費。

Some of the faux companies even hold strikes – a common occurrence in France. Axisco, a virtual payment processing center in Val d'Oise, recently staged a fake protest, with slogans and painted banners, to teach workers' rights and to train human resources staff members to calm tensions.

部分假公司甚至也搞罷工-這在法國常發生。瓦茲河谷省的虛擬支付處理中心Axisco,最近發動假抗議,口號和標語俱全,用以讓員工知道應有的權利,並訓練人力資源幹部如何緩解緊張。

"The products and the money are fake, but you call a virtual firm in Switzerland and a person answers," said Helene Dereuddre, 19, who was receiving administrative training at Candelia. "People see that they are capable of learning and working."

19歲、在Candelia接受行政工作訓練的海倫.德洛伊德耶說:「產品和錢都是假的,但你打電話給瑞士的虛擬公司,會有人接聽。人們明白,他們能學習和工作。」

At Candelia, Ms. Dereuddre spent a week compiling a catalog of discounted furniture and a spring sales brochure to move inventory that hadn't been selling well. To do so, she studied real market prices.

在Candelia,德洛伊德耶花一周時間編輯折價家具的目錄和春季大減價的宣傳冊子,出清銷路不好的存貨。為此,她研究真正的市場價格。

Several of the firms slid into virtual bankruptcy when they became unprofitable. When that happened, the staff members took steps to shut down the company. They also learned how to open a new one, including applying for loans at a fake bank.

幾家公司不賺錢,淪入虛擬破產狀態。這種情況發生時,工作人員採取關閉公司的步驟。他們也學習如何開一家新公司,包括向一家假銀行申請貸款。

About 60 to 70 percent of those who go through France's practice firms find jobs, Mr. Troton said.

特侯頓說,法國練習公司訓練出來的人,約有六成到七成找到工作。

Most are low-paying and last for short stints, sometimes only up to six months. Today, more than half of all new jobs in the European Union are temporary contracts, Eurostat said.

大部分是低薪和短期的工作,有時只有六個月。歐盟統計局說,今天,歐盟內的新工作一半以上是臨時約聘員工。

Armed with university degrees in literature and art, Bryan Scoth, 23, had searched seven months for work. After training at Candelia, he landed a one-year contract this spring as an administrator at an unemployment office in Lille. While the position was not what he had hoped for, it was a triumph after a string of rejections.

23歲的布萊恩.史考特擁有文學和藝術的大學文憑,工作已經找了七個月。在Candelia受訓後,他今春得到為期一年的約聘工作,在里爾一間失業輔導辦公室當行政人員。雖然這個職務不是他原先期望的,卻是在遭到一連串拒絕後的勝利。

"I've gotten my head above water," Mr. Scoth said.

史考特說:「我不再舉債度日了。」

 
訊息公告
 
滑手機眼睛傷很大!吃花青素護眼
滑手機現象隨處可見,餐廳、公車、捷運、排隊等位,非常傷眼睛,那麼吃什麼能保護眼睛?據研究,花青素、葉黃素及玉米黃素、維生素E、維生素C、茶多酚這些營養素對眼睛好。

成為專欄作家的最快捷徑
你的創作,需要被看見!【e世代文學報】徵求專欄作家,歡迎網路上的秀異寫作者來投稿報名,不拘形式,小說、散文、新詩都大歡迎!
 
本電子報著作權均屬「聯合線上公司」或授權「聯合線上公司」使用之合法權利人所有,
禁止未經授權轉載或節錄。若對電子報內容有任何疑問或要求轉載授權,請【
聯絡我們】。
  免費電子報 | 著作權聲明 | 隱私權聲明 | 聯絡我們
udnfamily : news | video | money | stars | health | reading | mobile | data | NBA TAIWAN | blog | shopping

1 則留言:

  1. Hey Thanks for sharing this blog it is very helpful to implement in our work

    Regards
    hire a hacker

    回覆刪除