Suppose there were a $1M bounty paid for each new security bug found in certain pieces of critical open source software? I'm thinking of packages like OpenSSL (obviously), glibc, etc. I think that an incentive of this sort would motivate not only individuals to find and report bugs, but also the development of new tools, (and use of existing tools), to accelerate the search.
A coalition of the major tech companies could easily fund a few thousand of these bounties, and we would quickly get a much more secure internet.
