Index: native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html |
diff --git a/native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html b/native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..d18b617bc3cdaedd0a1d068092b9667cc7848f08 |
--- /dev/null |
+++ b/native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html |
@@ -0,0 +1,928 @@ |
+{{+bindTo:partials.standard_nacl_article}} |
+ |
+<section id="security-contest-terms-and-conditions"> |
+<span id="contest-terms"></span><h1 id="security-contest-terms-and-conditions"><span id="contest-terms"></span>Security Contest Terms and Conditions</h1> |
+<aside class="caution"> |
+The Native Client Security Contest has ended—check out the |
+<a class="reference internal" href="/native-client/community/security-contest/index.html#contest-winners"><em>winning submissions</em></a>. We welcome your |
+continued involvement in the project. You can help by submitting |
+<a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">bugs</a> and |
+participating in the <a class="reference external" href="http://groups.google.com/group/native-client-discuss">Native Client discussion group</a>. |
+</aside> |
+<aside class="warning"> |
+This has been reformatted from the original, and the enumeration |
+list numbering style differs from the original document. |
+</aside> |
+<p>NO PURCHASE NECESSARY TO ENTER OR WIN. VOID WHERE PROHIBITED. CONTEST |
+IS OPEN TO RESIDENTS OF THE 50 UNITED STATES, THE DISTRICT OF COLUMBIA |
+AND WORLDWIDE, EXCEPT FOR ITALY, BRAZIL, QUEBEC, CUBA, IRAN, SYRIA, |
+NORTH KOREA, SUDAN AND MYANMAR.</p> |
+<p>ENTRY IN THIS CONTEST CONSTITUTES YOUR ACCEPTANCE OF THESE TERMS AND |
+CONDITIONS.</p> |
+<ol class="upperroman"> |
+<li><p class="first">Binding Agreement</p> |
+<p>In order to enter the Native Client Security Contest (“Contest”), |
+you must agree to these Terms and Conditions (“Terms”). Therefore, |
+please read these Terms prior to entry to ensure you understand and |
+agree. You agree that submission of an entry in the Contest |
+constitutes your agreement to these Terms. After reading the Terms |
+and in order to participate, each Participant (as defined below) |
+must complete the registration form, clicking the “I understand and |
+agree” box (or the equivalent), on the Contest entry webpage. Once |
+the Participant clicks the “I understand and agree” box (or the |
+equivalent), the Terms form a binding legal agreement between each |
+Participant and Google with respect to the Contest.</p> |
+<p>Participants may not submit an Exploit, Issue or Summary to the |
+Contest and are not eligible to receive the prizes described in |
+these Terms unless they agree to these Terms. If a Participant is |
+part of a team, each member of the team must read and agree to |
+these Terms and click on the “I understand and agree” box (or the |
+equivalent) described herein. Failure of any member of a team to |
+agree to these Terms and click on the “I understand and agree” box |
+(or the equivalent) described herein will disqualify the entire |
+team.</p> |
+<p>By entering, Participant warrants that Participant has not violated |
+any employment agreement or other restriction imposed by his or her |
+employer by participating in this Contest.</p> |
+</li> |
+<li><p class="first">Description</p> |
+<p>The Contest is organized by Google and is designed to motivate the |
+developer community to identify and report security Exploits (as |
+defined below) on Google’s Native Client software and reward those |
+developers who identify one or more security Exploits that are |
+evaluated as a winning exploit by the Judges.</p> |
+<p>Once a Participant has registered for the Contest, the Participant |
+will be asked to identify security Exploits in Google’s Native |
+Client Software and enter those Exploits on Google’s <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client |
+Issue Tracker</a> |
+web site using the “Security Contest Template.” At this point, the |
+Exploit will become an Issue and will no longer be able to be |
+identified by another Participant. Google will then verify that the |
+Issue is reproducible. If so, that Issue will become a Verified |
+Issue. Finally, the Participant will submit a Summary of up to his |
+or her top ten best Issues that were submitted on the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native |
+Client Issue Tracker</a>. Since it is |
+possible that an Issue may not be verified until after the Contest |
+End Date, if a Participant includes such an Issue in their Summary |
+and such Issue is not ultimately verified, then that Issue will not |
+be considered to be part of the Summary.</p> |
+<p>Prizes will be awarded to those Participants who submit the best |
+Summaries as determined in the sole discretion of the Judges when |
+considering the Judging Criteria described herein.</p> |
+</li> |
+<li><p class="first">Sponsor</p> |
+<p>The Contest is sponsored by Google Inc. (“Google” or “Sponsor”), a |
+Delaware corporation with its principal place of business at 1600 |
+Amphitheater Parkway, Mountain View, CA, 94043, USA.</p> |
+</li> |
+<li><p class="first">Term</p> |
+<p>The Contest begins at 9:00:00 A.M. Pacific Time (PT) Zone in the |
+United States on Februrary 25th, 2009 (“Contest Start Date”) and |
+ends at 11:59:59 P.M. PT on May 5th, 2009 (“Contest End |
+Date”). Participants must register by May 5th, 2009 at 11:59:59 |
+Pacific Time to be eligible to participate. ENTRANTS ARE |
+RESPONSIBLE FOR DETERMINING THE CORRESPONDING TIME ZONE IN THEIR |
+RESPECTIVE JURISDICTIONS.</p> |
+</li> |
+<li><p class="first">Definitions</p> |
+<p>Throughout these Terms, Google will use the following defined terms |
+and words. Please review them carefully to ensure you understand.</p> |
+<ol class="arabic simple"> |
+<li>Covert Channel Attack: A “Covert Channel Attack” means an |
+attempt to manipulate certain properties of a communications |
+medium in an unexpected, unconventional, or unforeseen way in |
+order to transmit information through the medium without |
+detection by anyone other than the entities operating the covert |
+channel. Exploits that are Covert Channel Attacks are excluded |
+from the Contest.</li> |
+<li>Exploit: An “Exploit” means a sequence of steps that require and |
+use Native Client to produce or have the potential to produce |
+behavior prohibited by Native Client’s security policies and |
+design which can be found at |
+<a class="reference external" href="http://src.chromium.org/viewvc/native_client/trunk/src/native_client/README.html">http://src.chromium.org/viewvc/native_client/trunk/src/native_client/README.html</a>. |
+Google reserves the right to modify the security policies and |
+design at any time. An example of an Exploit would be producing |
+file system or network access outside of the scope of |
+permissible use via JavaScript in a browser. An Exploit that |
+defeats one but not all Native Client security measures is still |
+considered to produce behavior prohibited by Native Client’s |
+security policies for the purposes of this Contest and would be |
+entitled to be identified as an Exploit in the Contest.</li> |
+<li>Inner Sandbox: The “Inner Sandbox” means the Native Client |
+security system that a) inspects executables before running them |
+to try to detect the potential for an executable to produce |
+prohibited behavior, and b) prevents from running any |
+executables that are detected to have the potential to produce |
+prohibited behavior.</li> |
+<li>Issue: An “Issue” means an entry of a single Exploit by a |
+Participant into the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a> using a |
+properly filled out Security Contest Template. Once the Exploit |
+has been properly entered it becomes an Issue.</li> |
+<li>Native Client Issue Tracker: The “Native Client Issue Tracker” |
+is located at |
+<a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">http://code.google.com/p/nativeclient/issues/list</a>. It is a web |
+application that manages and maintains a list of Issues, |
+including Issues that are not eligible for contest entry.</li> |
+<li>Native Client Version Number: The “Native Client Version Number” |
+is defined as the number between the platform name (separated by |
+an ‘_’) and the file extension (separated by a ‘.’) in the |
+Native Client download. For example, if the the filename of the |
+download on the Native Client download page is |
+“nacl_linux_0.1_32_2009_01_16.tgz” or |
+“nacl_windows_0.1_32_2009_01_16.zip”, the Version Number is |
+“0.1_32_2009_01_16”.</li> |
+<li>Outer Sandbox: The “Outer Sandbox” means the Native Client |
+security system that 1) observes executables while they are |
+running to detect the attempts at prohibited behavior and 2) |
+terminates misbehaving executables if it observes any attempts |
+to produce prohibited behavior.</li> |
+<li>Participant: A “Participant” means any individual or team of |
+individuals that has agreed to these Terms, meets the |
+eligibility criteria described below, and is participating in |
+the Contest.</li> |
+<li>Side Channel Attack: A “Side Channel Attack” means any attack |
+based on information gained as a side-effect of the |
+implementation of a cryptosystem, rather than brute force or |
+theoretical weaknesses in the algorithms. For example, attacks |
+that use timing information, power consumption variation, |
+electromagnetic leaks or sound to obtain information illicitly |
+are side channel attacks. Exploits that are Side Channel Attacks |
+are excluded from the Contest.</li> |
+<li>Summary: A “Summary” means the final electronic document |
+complying with the requirements of Section X that each |
+Participant must submit in order to participate in the |
+Contest. A Summary may contain up to 10 Issues. If Issues do not |
+ultimately become Verified Issues, they will not be considered |
+as part of the Summary and Participant understands and accepts |
+the risk that if the Participant identified an Issue on a |
+Summary that had not yet been verified, that Issue will not be |
+considered as part of the Summary if not subsequently verified.</li> |
+<li>Verified Issue: A “Verified Issue” means an Exploit that has |
+been a) submitted to the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a> in |
+accordance with these Terms, and b) confirmed by the Native |
+Client team at Google to exhibit the behavior described in the |
+Issue report.</li> |
+</ol> |
+</li> |
+<li><p class="first">Eligibility</p> |
+<p>The Contest is open to Participants who (1) have agreed to these |
+Terms; (2) who are of or above the legal age of majority, at the |
+time of entry, to form valid contracts in their respective country, |
+province or state of legal residence (and at least the age of 20 in |
+Taiwan); (3) are not residents of Italy, Brazil, Quebec, Cuba, |
+Iran, Syria, North Korea, Sudan, or Myanmar; and (4) who have |
+software development experience. Sponsor reserves the right to |
+verify eligibility and to adjudicate on any dispute at any |
+time. The Contest is void in, and not open to residents of, Italy, |
+Brazil, Quebec, Cuba, Iran, Syria, North Korea, Sudan, Myanmar, or |
+to individuals and entities restricted by U.S. export controls and |
+sanctions, and is void in any other nation, state, or province |
+where prohibited or restricted by U.S. or local law.</p> |
+<p>Employees and contractors of Google, affiliates and subsidiaries of |
+Google, the Judges and members of their immediate families (defined |
+as parents, children, siblings and spouse, regardless of where they |
+reside and/or those living in the same household of each) are not |
+eligible to participate in the Contest. Judges may not help any |
+Participant with their submissions and Judges must recuse |
+themselves in cases where they have a conflict of interest that |
+becomes known to the Judge.</p> |
+</li> |
+<li><p class="first">Registration & Entry Process</p> |
+<ol class="arabic"> |
+<li><p class="first">All Participants must register at |
+code.google.com/contests/nativeclient-security/ by May 5th, 2009 |
+at 11:59:59 Pacific Time. All individuals participating in the |
+Contest (either as an individual Participant or as a member of a |
+team) must provide the following registration information:</p> |
+<ol class="loweralpha simple"> |
+<li>Email Address(es) of the Participant. The first member of a |
+team to register must list the email addresses of all |
+members of the Participant team, and all members must |
+ultimately agree to the Terms as described more fully below.</li> |
+<li>Nationality and primary place of residence of the Participant.</li> |
+<li>If the Participant is a team, the email address of the team |
+member who is selected to be the recipient of the prize. The |
+first member of the team to register will designate this |
+information in the initial team registration.</li> |
+<li>Participant name, which is the team name in the case of a |
+team or the user name chosen by an individual in the case of |
+an individual Participant.</li> |
+</ol> |
+<p>Failure to fully, completely and accurately provide this |
+information will disqualify the Entry.</p> |
+</li> |
+<li><p class="first">Any potential prize recipient may be required to show proof of |
+being the authorized account holder for an email address. The |
+“Authorized Account Holder” is the natural person assigned to an |
+email address by the relevant provider of email services.</p> |
+</li> |
+<li><p class="first">Participants that are teams must provide the above registration |
+information for every individual who is a member of the |
+team. Every individual who is part of the team must agree to the |
+Terms in order for the team to be eligible to participate by |
+clicking the “I understand and agree” box (or the equivalent) on |
+the Contest entry webpage. Members of a team will be able to |
+edit the information relating to the team only until the last |
+member of the team has accepted these Terms by clicking the “I |
+understand and agree” box (or the equivalent) on the Contest |
+entry webpage. Issues submitted by members of a team prior to |
+the time that all individual members of the team have clicked |
+the “I understand and agree” box (or the equivalent) will not be |
+valid Issue submissions and will not be eligible entries in the |
+Contest. Google will send an email to all members of the team |
+when the final team member has accepted the terms, however |
+Google will have no liability for failure to send such an email |
+or for the failure of any team member to receive the email.</p> |
+</li> |
+<li><p class="first">Issues submitted by Participants who are individuals prior to |
+the time that the individual has clicked the “I understand and |
+agree” box (or the equivalent) will not be valid Issue |
+submissions and will not be eligible entries in the |
+Contest. Google will send an email to the individual when the |
+individual has accepted the terms, however Google will have no |
+liability for failure to send such an email or for the failure |
+of any team member to receive the email.</p> |
+</li> |
+<li><p class="first">All entries become the property of Sponsor and will not be |
+acknowledged or returned. Entries are void if they are in whole |
+or part illegible, incomplete, damaged, altered, counterfeit, |
+obtained through fraud, or late.</p> |
+</li> |
+<li><p class="first">LIMIT ONE ENTRY PER PERSON. Individuals may only enter one time, |
+whether as an individual Participant or as a team |
+Participant. Google, in its sole discretion, may disqualify any |
+Participant (including team Participants) that it believes has |
+violated this provision.</p> |
+</li> |
+</ol> |
+</li> |
+<li><p class="first">Submission Process</p> |
+<ol class="arabic simple"> |
+<li>Each Participant must submit:<ol class="loweralpha"> |
+<li>At least one Issue in the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a> that |
+describes an Exploit and includes the information detailed |
+in the “Issues” section below. Any team member can submit an |
+Issue on behalf of the team. All entries will be deemed made |
+by the Authorized Account Holder of the email address |
+submitted at the time of entry.</li> |
+<li>One Summary per Participant that includes the information |
+detailed in the “Summary” section below. Participant will be |
+entitled to amend its Summary until the Contest End Date and |
+only the last version will be considered by the Judges.</li> |
+</ol> |
+</li> |
+<li>Each Issue must be written in the English language. Google or |
+the Judges may refuse to review submissions that they deem |
+incomprehensible, include Issues that are not repeatable as |
+determined by Google, or that otherwise do not meet the |
+requirements of these Terms.</li> |
+<li>To enter an Issue in the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a>, each |
+Participant must use the “Security Contest Template” and provide |
+completely and accurately all information requested by the |
+template. Any Issues that are not entered with the “Security |
+Contest Template” may not be considered by the Judges. Each |
+Issue must contain the items described in the “Issues” section |
+of these Terms.</li> |
+</ol> |
+</li> |
+<li><p class="first">Issues</p> |
+<ol class="arabic simple"> |
+<li>Minimum requirements for Issues: Participant must identify an |
+Exploit and enter the Exploit into the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue |
+Tracker</a>. Once the |
+Exploit is submitted it becomes an Issue. Each submitted Issue |
+must include (i) the following information and (ii) all |
+additional information requested on the “Security Contest |
+Template”:<ol class="loweralpha"> |
+<li>The user name (in the case of Individual Participants) or |
+the team name (in the case of team Participants) of the |
+Participant submitting the Issue, which must be identical to |
+the user name or team name submitted during the registration |
+process.</li> |
+<li>A gzipped tar archive (with paths relative to |
+nacl/googleclient/native_client/tests/) that contains any |
+instructions and files necessary to reproduce the Exploit, |
+which must include:<ol class="arabic"> |
+<li>A README.txt file that describes:<ul class="small-gap"> |
+<li>The version number of current version of Native Client |
+at the time of submission. Issues submitted with a |
+version number listed other than the current version |
+at the time of submission will be invalid;</li> |
+<li>The steps required to reproduce the Exploit;</li> |
+<li>The effect of the Exploit; and</li> |
+<li>Platform requirements for the Exploit, including but |
+not necessarily limited to:</li> |
+<li>browser version;</li> |
+<li>operating system name(s) and version(s); and/or</li> |
+<li>any other platform requirements relevant to the Exploit.</li> |
+</ul> |
+</li> |
+<li>If the Exploit requires a binary executable, both the |
+source code and binary executable must be provided upon |
+creation of the Issue. Any subsequent updates to the |
+source code or binary executable after the creation of |
+the Issue will not be considered for the purposes of |
+this Contest. The binary executable must build cleanly |
+by executing the command “make” in the exploit directory |
+(e.g. nacl/googleclient/native_client/tests/exploit1).</li> |
+</ol> |
+</li> |
+</ol> |
+</li> |
+<li>Verified Issues: In order for an Issue to become a Verified |
+Issue, Google will first examine the submitted Issue to |
+determine whether it complies with the following:<ol class="loweralpha"> |
+<li>The Exploit must not contain or depend upon access or use of |
+any third party software or code that Google does not have |
+readily available to it or that would require complying with |
+third party license agreement that Google in its sole |
+discretion deems onerous or burdensome.</li> |
+<li>Google must be able to replicate the Exploit in its sole |
+discretion.</li> |
+<li>The Exploit must affect at least one “opt-” platform from a |
+standard build of the most recent released version of Native |
+Client as of the time of submission of the Issue for the |
+Exploit.</li> |
+</ol> |
+</li> |
+<li>Timeliness<ol class="loweralpha"> |
+<li>If the vulnerability exposed by the submitted Exploit was |
+disclosed in a previously reported Issue (whether or not |
+submitted by a Participant) or in the previously published |
+Native Client release notes, the submission will be invalid |
+for the purposes of this Contest. Two Exploits are |
+considered to expose the same vulnerability if the |
+theoretical patch required to fix one vulnerability also |
+fixes the second vulnerability.</li> |
+<li>Google will update the Native Client source code base at |
+most twice per week. These updates, if they occur, will |
+appear Mondays and Thursdays between 3 p.m. and 8 |
+p.m. Pacific Time.</li> |
+<li>Issues will not be valid if they have been entered before |
+the later of (i) the Contest Start Date or (ii) the time at |
+which all members of a team Participant or the individual |
+Participant, as the case may be, have accepted these Terms.</li> |
+</ol> |
+</li> |
+<li>Excluded Exploits. The following types of Exploits are invalid |
+for the purposes of this Contest:<ul class="small-gap"> |
+<li>Covert Channel Attacks;</li> |
+<li>Sidechannel Attacks;</li> |
+<li>Exploits requiring a virtualized CPU;</li> |
+<li>Exploits that rely on features, misfeatures or defects of |
+virtual machines (i.e. VMWare, Xen, Parallels etc.);</li> |
+<li>Exploits that require the machine to be previously compromised |
+by malicious software (including but not limited to viruses or |
+malware); and</li> |
+<li>Exploits that rely on hardware failures, other than Exploits |
+which, in Google’s sole judgment, depend on CPU errata but |
+which can be reproduced reliably with a common system |
+configuration and under normal operating conditions, or |
+statistically improbable hardware behaviors. Examples include |
+but are not limited to Exploits that rely on memory errors |
+induced by cosmic radiation, and Exploits that require |
+abnormal heating, cooling or other abnormal physical |
+conditions.</li> |
+</ul> |
+</li> |
+<li>Completeness. Issues submitted that lack any of the above |
+materials or fail to meet any of the above criteria, may not be |
+considered in the judging process at Google’s sole |
+discretion. Issues that are not included in a Participant |
+Summary (see section below) will not be considered.</li> |
+</ol> |
+</li> |
+<li><p class="first">Summary</p> |
+<ol class="arabic simple"> |
+<li>Every Participant must submit a Summary at the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client |
+Issue Tracker</a> complying |
+with the requirements of this section. The Participant must |
+select no more than 10 of the Verified Issues submitted by the |
+Participant for inclusion on the Summary. Each Summary must be |
+in English and must contain the following information:<ul class="small-gap"> |
+<li>The Issues must be listed in descending order of severity, as |
+determined by the Participant in accordance with the Judging |
+Criteria.</li> |
+<li>Each Issue listed in the Summary must be identified by ID |
+number of the Issue. The ID number is the identifying number |
+created for each Issue as listed on the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue |
+Tracker</a>.</li> |
+<li>A description of the effect of each Exploit.</li> |
+<li>The platform requirements of each Exploit.</li> |
+<li>The version number(s) of Native Client software affected by |
+each Exploit (which must be the version number of the Native |
+Client software current at the time the Issue was submitted to |
+the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a>).</li> |
+<li>Any other details about the Exploit and the submission that |
+are relevant to the judging criteria, such as, for example, |
+the approach used in finding the exploits, innovative or |
+scalable techniques used to discover exploits, or |
+architectural analysis.</li> |
+<li>The team name or user name of the Participant. Google may, in |
+its sole discretion, eliminate or disqualify any Summary that |
+lists user names or team names that are not identical to the |
+user name or team name of the Participant listed on the |
+Contest entry form.</li> |
+</ul> |
+</li> |
+<li>Each Summary must be a maximum of 8 pages long, in PDF format |
+viewable with Adobe Reader version 9. The Summary must be |
+formatted for 8.5 inches x11 inches or A4 paper, with a minimum |
+font size of 10 pt. Any submission that does not meet these |
+formatting criteria may be disqualified at the sole discretion |
+of Google.</li> |
+<li>All Issues listed in the Summary will be verified by Google |
+before submission of the Summary to the Judges after the Contest |
+Closing Date. Participants may submit or resubmit their Summary |
+at any time during the duration of the Contest, however, the |
+Judges will consider only the last Summary from each Participant |
+prior to the Contest Closing Date and ignore all other Summaries |
+previously submitted by the Participant.</li> |
+</ol> |
+</li> |
+<li><p class="first">Judging</p> |
+<ol class="arabic"> |
+<li><p class="first">After the Contest End Date and on or about May 15th, 2009, all |
+submitted Summaries will be judged by one of at least three |
+panels with a minimum of three experts in the field of online |
+security (“Judges”) on each panel. Judges will evaluate each |
+Summary in accordance with the Judging Criteria described |
+below. Each panel will evaluate a number of the submitted |
+Summaries using the Judging Criteria described below and will |
+select the highest ranking Summaries to move to the next level |
+of judging. During the first round of judging, each panel will |
+select no more than ten Summaries to move forward to the second |
+round of judging unless there is a tie between or among any |
+Participants. During the second round of judging, those |
+Summaries selected during the first round of judging will then |
+be evaluated by all Judges using the below Judging Criteria and |
+the top five Summaries will be selected as potential |
+winners. All decisions of the Judges are final and binding.</p> |
+</li> |
+<li><p class="first">Judging Criteria. The Judges will consider each Summary under |
+following judging criteria (“Judging Criteria”):</p> |
+<ol class="loweralpha"> |
+<li><p class="first">Quality of Exploit. Quality will be decided by the Judges in |
+their sole discretion and will be based on (in order of |
+importance to the Judges) Severity, Scope, Reliability and |
+Style.</p> |
+<ol class="lowerroman"> |
+<li><p class="first">Severity: the more disruptive the effects of the |
+Exploit, the higher its quality. Here is a |
+non-exhaustive ranking of the most common Exploits |
+starting from ‘minor’ to ‘severe’:</p> |
+<ul class="small-gap"> |
+<li><p class="first">Browser crash;</p> |
+</li> |
+<li><p class="first">Denial of service or machine crash;</p> |
+</li> |
+<li><p class="first">Compromise of the Outer Sandbox;</p> |
+</li> |
+<li><p class="first">Information leak (such as of a cookie or password);</p> |
+</li> |
+<li><p class="first">Compromise of both the Inner and Outer Sandbox; and/or</p> |
+</li> |
+<li><p class="first">Prohibited side effect (such as reading or writing |
+files to the client machine), escalation of privilege |
+(such as executing other programs outside of Native |
+Client).</p> |
+</li> |
+</ul> |
+<p>Any Exploit that does not address the above elements |
+will be evaluated on a case-by-case basis and the |
+severity of such Exploits will be determined solely at |
+the Judge’s discretion.</p> |
+</li> |
+<li><p class="first">Scope: the more computers that an Exploit would |
+potentially affect, the bigger its scope and therefore |
+higher the quality of the Exploit. Consider the |
+following:</p> |
+<ul class="small-gap"> |
+<li><p class="first">Exploits that affect all platforms supported by Native |
+Client (where platform is defined as a browser, |
+operating system and hardware combination) have higher |
+quality than an Exploit specific to a particular |
+platform.</p> |
+</li> |
+<li><p class="first">Exploits that require non-current or beta versions |
+(historic or future) of hardware or software are lower |
+quality.</p> |
+</li> |
+<li><p class="first">Exploits that rely on concurrent usage of other |
+installed software or web content must make a |
+compelling case about the likelihood of the |
+prerequisite software or content being present, or |
+they will be considered of lower quality.</p> |
+</li> |
+</ul> |
+</li> |
+<li><p class="first">Reliability: The more frequent or probable the |
+occurrence identified by the Exploit, the more |
+“reliable” it may be. Consider the following:</p> |
+<ul class="small-gap"> |
+<li><p class="first">Exploits that require uncommon software to be |
+installed on the machine in order to function will be |
+deemed to have lower quality.</p> |
+</li> |
+<li><p class="first">Entries that include Exploits that cannot be |
+reproduced 100% of the time, but which can be |
+reproduced a significant percentage of the time, will |
+be deemed to have a lower quality to account for a |
+lowered probability that the attack will succeed.</p> |
+</li> |
+</ul> |
+</li> |
+<li><p class="first">Style: Submissions that demonstrate exceptional style |
+will receive a higher ranking. Factors that contribute |
+to style include:</p> |
+<ul class="small-gap"> |
+<li><p class="first">Ingenuity in mechanism used to bypass security;</p> |
+</li> |
+<li><p class="first">Uniqueness of the Exploit;</p> |
+</li> |
+<li><p class="first">Ingenuity in methods used to discover vulnerabilities; |
+and/or Minimal size of Exploit to achieve the effect.</p> |
+</li> |
+</ul> |
+</li> |
+</ol> |
+</li> |
+<li><p class="first">the Quantity of Exploits: Participants that submit more |
+Exploits in their Summary (but no more than 10) may receive |
+a higher ranking, weighted by quality. However, it is still |
+possible that a Participant who submits one Exploit could |
+still outweigh a Participant that submits several Exploits.</p> |
+</li> |
+</ol> |
+<p>Considering each of the factors described above, the Judges will |
+give each Summary a “Score” from 1-10 that represents the Judges |
+evaluation of the Summary. This “score” will determine which |
+participants move from the first round of judging to the second |
+round of judging, and which participants will be selected as a |
+winner.</p> |
+</li> |
+<li><p class="first">Winner Selection</p> |
+<p>Judges will review the Summaries as discussed in the “Judging” |
+section, above. The Summaries with the five (5) highest scores |
+will be selected as potentially winning Participants. In the |
+event of a tie ranking for two or more Summaries, the |
+Participant whose Summary had the highest ranking for “Severity” |
+will receive the higher prize. In the event of a second tie, the |
+Participant whose Summary had the highest ranking for “Scope” |
+will receive the higher prize. Odds of winning depend on the |
+number of eligible entries received and the skill of the |
+Participants.</p> |
+<p>The Judges are under no obligation to provide feedback on their |
+decisions or on their judgment on specific Exploits they |
+consider.</p> |
+</li> |
+<li><p class="first">Team Winners</p> |
+<p>A special note about the prize distribution process for |
+Participants who are entering as part of a team:</p> |
+<p>A single member of each team shall be designated to receive the |
+prize, if any, awarded to such team at the initial registration |
+of the team, and Google shall have no responsibility for |
+distribution of the prize among the team members.</p> |
+<p>Each individual that enters as part of a team, understands and |
+agrees that if his/her team is selected to receive a prize, the |
+team is responsible for ensuring the funds are appropriately |
+distributed to each member of the team. In addition, once a team |
+has registered, the team may not add, remove, or substitute any |
+members or otherwise change the composition of the team for the |
+duration of the Contest. If any member of a team does not comply |
+with these Terms, is ineligible or is disqualified, the team as |
+a whole may be disqualified in Google’s sole discretion.</p> |
+</li> |
+</ol> |
+</li> |
+<li><p class="first">Prizes</p> |
+<ol class="arabic"> |
+<li><p class="first">Information Required for Eligibility</p> |
+<ol class="loweralpha simple"> |
+<li>On or about May 15th 2009 and upon selection of potential |
+winners, Google will contact all winning Participants using |
+the email addresses submitted at registration. In order to |
+win the Contest and receive prizes, Participants, including |
+each individual on a team, must provide additional |
+information including:<ul class="small-gap"> |
+<li>first and last name;</li> |
+<li>address;</li> |
+<li>phone number; and</li> |
+<li>all other necessary information required by the US tax and |
+legal authorities and /or the authorities of the countries |
+they reside in.</li> |
+</ul> |
+</li> |
+<li>All Participants will need to verify their identity with |
+Google, before receiving their prize; however, Participants |
+may provide an alias for use in any public documentation and |
+marketing material issued publicly by Google, subject to |
+limitations of the law and as required by law |
+enforcement. Please be aware that in some jurisdictions, a |
+list of winners must be made available and your name, and |
+not the alias, will be provided on that list. If a |
+Participant, or in the case of a team, any individual member |
+of the team, refuses or fails to provide the necessary |
+information to Google within 14 days of the Contest |
+administrators’ request for the required information, then |
+Google may, in its sole discretion, disqualify the |
+Participant’s entry and select as an alternative potential |
+winner the Participant with the next highest overall |
+ranking. Google will not be held responsible for any failure |
+of potential winners to receive notification that they are |
+potential winners. Except where prohibited by law, each |
+potential winner may be required to sign and return a |
+Declaration of Eligibility, Liability & Publicity Release |
+and Release of Rights and provide any additional information |
+that may be required by Google. If required, potential |
+winners must return all such required documents within 14 |
+calendar days following attempted notification or such |
+potential winner will be deemed to have forfeited the prize |
+and Google will select the Participant with the next highest |
+overall ranking as the potential winner.</li> |
+<li>Prizes will be awarded within 6 months after the Contest End Date.</li> |
+<li>If fewer than 5 Participants or teams are found eligible, |
+fewer than 5 winners will be selected.</li> |
+<li>Prizes are not transferable or substitutable, except by |
+Google in its sole discretion in the event a prize becomes |
+unavailable for any reason. In such an instance, Google will |
+award a prize of equal or greater value.</li> |
+<li>LIMIT: Only one prize per Participant.</li> |
+</ol> |
+</li> |
+<li><p class="first">Prize Amounts and Announcement</p> |
+<p>Provided that the Participant has complied with these Terms, |
+eligible Participants that are ranked in the top 5 positions of |
+the competition by Judges will receive the following awards in |
+U.S. Dollars based on their rank: 1st prize: $8,192.00, 2nd |
+prize: $4,096.00, 3rd prize: $2,048.00, 4th prize: $1,024.00, |
+5th prize: $1,024.00. Winning Entries will be announced on or |
+about December 7th.</p> |
+</li> |
+<li><p class="first">Distribution of a Prize</p> |
+<p>Google is not responsible for any division or distribution of |
+the prizes among or between team members. Distribution or |
+division of the prize among individual team members is the sole |
+responsibility of the participating team. Google will award the |
+prize only to the one (1) member of the team, who was identified |
+by the Participant to receive the prize as part of the |
+registration process. Google will attempt to reach only the |
+designated recipient for purposes of distribution of the prize.</p> |
+<p>Prizes are awarded without warranty of any kind from Google, |
+express or implied, without limitation, except where this would |
+be contrary to federal, state, provincial, or local laws or |
+regulations. All federal, state, provincial and local laws and |
+regulations apply.</p> |
+</li> |
+<li><p class="first">Taxes</p> |
+<p>Payments to potential prize winners are subject to the express |
+requirement that they submit to Google all documentation |
+requested by Google to permit it to comply with all applicable |
+US, state, local and foreign (including provincial) tax |
+reporting and withholding requirements. All prizes will be net |
+of any taxes Google is required by law to withhold. All taxes |
+imposed on the prize are the sole responsibility of the prize |
+recipient.</p> |
+<p>In order to receive a prize, potential prize recipients must |
+submit the tax documentation requested by Google or otherwise |
+required by applicable law, to Google or the relevant tax |
+authority, all as determined by applicable law, including, where |
+relevant, the law of the potential prize recipient’s country of |
+residence. The potential prize recipient is responsible for |
+ensuring that (s)he complies with all the applicable tax laws |
+and filing requirements. If a potential prize recipient fails to |
+provide such documentation or comply with such laws, the prize |
+may be forfeited and Google may, in its sole discretion, select |
+an alternative potential prize recipient.</p> |
+</li> |
+</ol> |
+</li> |
+<li><p class="first">General Conditions</p> |
+<ol class="arabic"> |
+<li><p class="first">Right to Disqualify. A Participant may be prohibited from |
+participating in or be disqualified from this Contest if, in |
+Google’s sole discretion, it reasonably believes that the |
+Participant or any member of a Participant team has attempted to |
+undermine the legitimate operation of the Contest by cheating, |
+deception, or other unfair playing practices or annoys, abuses, |
+threatens or harasses any other Participants, Google, or the |
+Judges. Google further reserves the right to disqualify any |
+Issue that it believes in its sole and unfettered discretion |
+infringes upon or violates the rights of any third party, |
+otherwise does not comply with these Terms, or violates U.S. or |
+applicable local law in Participant’s country of residence.</p> |
+<p>Google further reserves the right to disqualify any Participant |
+who tampers with the submission process or any other part of the |
+Contest. Any attempt by a Participant to deliberately damage any |
+web site or undermine the legitimate operation of the Contest is |
+a violation of criminal and civil laws and should such an |
+attempt be made, Google reserves the right to seek damages from |
+any such Participant to the fullest extent of the applicable |
+law.</p> |
+</li> |
+<li><p class="first">Internet Disclaimer. Google is not responsible for any |
+malfunction of the entire Contest, the web site displaying the |
+Contest terms and entry information, or any late, lost, damaged, |
+misdirected, incomplete, illegible, undeliverable, or destroyed |
+Exploits, Issues or Summaries due to system errors, failed, |
+incomplete or garbled computer or other telecommunication |
+transmission malfunctions, hardware or software failures of any |
+kind, lost or unavailable network connections, typographical or |
+system/human errors and failures, technical malfunction(s) of |
+any telephone network or lines, cable connections, satellite |
+transmissions, servers or providers, or computer equipment, |
+traffic congestion on the Internet or at the web site displaying |
+the Contest or any combination thereof, including other |
+telecommunication, cable, digital or satellite malfunctions |
+which may limit an entrant’s ability to participate. Google is |
+not responsible for availability of the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue |
+Tracker</a> |
+from your preferred point of Internet access. In the event of a |
+technical disruption, Google may, in its sole discretion, extend |
+the Contest End Date for a reasonable period. Google will |
+attempt to notify Participants of any such extension by email at |
+the email address in the registration information, but shall |
+have no liability for any failure of such notification.</p> |
+</li> |
+<li><p class="first">Exploits Independently Discovered by Google. You acknowledge and |
+understand that Google may discover Exploits independently that |
+may be similar to or identical to your Issues in terms of |
+function, vulnerability, or in other respects. You agree that |
+you will not be entitled to any rights in, or compensation in |
+connection with, any such similar or identical applications |
+and/or ideas. You acknowledge that you have submitted your entry |
+voluntarily and not in confidence or in trust.</p> |
+</li> |
+<li><p class="first">No Contract for Employment. You acknowledge that no |
+confidential, fiduciary, agency or other relationship or |
+implied-in-fact contract now exists between you and Google and |
+that no such relationship is established by your submission of |
+an entry to Google in this Contest. Under no circumstances shall |
+the submission of an entry in the Contest, the awarding of a |
+prize, or anything in these Terms be construed as an offer or |
+contract of employment with Google.</p> |
+</li> |
+<li><p class="first">Intellectual Property Rights and License. Participants warrant |
+that their Exploit and Summary are their own original work and, |
+as such, they are the sole and exclusive owner and rights holder |
+of the submitted Exploit and Summary and that they have the |
+right to submit the Exploit and Summary in the Contest and grant |
+all required licenses. Each Participant agrees not to submit any |
+Exploit and Summary that (a) infringes any third party |
+proprietary rights, intellectual property rights, industrial |
+property rights, personal or moral rights or any other rights, |
+including without limitation, copyright, trademark, patent, |
+trade secret, privacy, publicity or confidentiality obligations; |
+or (b) otherwise violates the applicable state, federal, |
+provincial or local law.</p> |
+<p>As between Google and the Participant, the Participant retains |
+ownership of all intellectual and industrial property rights in |
+and to the Issues and Summary that Participant created. As a |
+condition of entry, Participant grants Google a perpetual, |
+irrevocable, worldwide, royalty-free, and non-exclusive license |
+to use, reproduce, publicly perform, publicly display, |
+distribute, sublicense and create a derivative work from, any |
+Issue or Summary that Participant submits to this Contest for |
+the purposes of allowing Google to test, evaluate and fix or |
+remedy the Issue and Summary for purposes of the Contest and |
+modifying or improving the Native Client software or any other |
+current or future Google product or service.</p> |
+<p>Participant also grants Google the right to reproduce and |
+distribute the Issue and the Summary. In addition, Participant |
+specifically agrees that Google shall have the right to use, |
+reproduce, publicly perform, and publicly display the Issue and |
+Summary in connection with the advertising and promotion of the |
+Native Client software or any other current or future Google |
+product or service via communication to the public or other |
+groups, including, but not limited to, the right to make |
+screenshots, animations and video clips available for |
+promotional purposes.</p> |
+</li> |
+<li><p class="first">Privacy. Participants agree that personal data provided to |
+Google during the Contest, including name, mailing address, |
+phone number, and email address may be processed, stored, and |
+otherwise used for the purposes and within the context of the |
+Contest. This data will be maintained in accordance with the |
+Google Privacy Policy found at |
+<a class="reference external" href="http://www.google.com/privacypolicy.html">http://www.google.com/privacypolicy.html</a>. This data will also be |
+transferred into the United States. By entering, Participants |
+agree to the transmission, processing, and storage of this |
+personal data in the United States.</p> |
+<p>Participants also understand this data may be used by Google in |
+order to verify a Participant’s identity, postal address and |
+telephone number in the event a Participant qualifies for a |
+prize. Participants have the right to access, review, rectify or |
+cancel any personal data held by Google in connection with the |
+Contest by writing to Google at the address listed below in the |
+section entitled “Winner’s List.”</p> |
+<p>For residents of the European Union:</p> |
+<p>Pursuant to EU law pertaining to data collection and processing, |
+you are informed that:</p> |
+<ul class="small-gap"> |
+<li><p class="first">The data controller is Google and the data recipients are |
+Google and its agents;</p> |
+</li> |
+<li><p class="first">Your data is collected for purposes of administration of the |
+Native Client Security Contest;</p> |
+</li> |
+<li><p class="first">You have a right of access to and withdrawal of your personal |
+data. You also have a right of opposition to the data |
+collection, under certain circumstances. To exercise such |
+right, You may write to: Native Client Security Contest, |
+Google Inc., 1600 Amphitheater Parkway, Mountain View, CA |
+94043, USA.</p> |
+</li> |
+<li><p class="first">Your personal data will be transferred to the U.S.</p> |
+</li> |
+</ul> |
+</li> |
+<li><p class="first">Indemnity. To the maximum extent permitted by law, each |
+Participant indemnifies and agrees to keep indemnified Google |
+and Judges at all times from and against any liability, claims, |
+demands, losses, damages, costs and expenses resulting from any |
+act, default or omission of the Participant and/or a breach of |
+any warranty set forth herein. To the maximum extent permitted |
+by law, each Participant agrees to defend, indemnify and hold |
+harmless Google, its affiliates and their respective directors, |
+officers, employees and agents from and against any and all |
+claims, actions, suits or proceedings, as well as any and all |
+losses, liabilities, damages, costs and expenses (including |
+reasonable attorneys fees) arising out of or accruing from:</p> |
+<ol class="loweralpha simple"> |
+<li>any material uploaded or otherwise provided by the |
+Participant that infringes any copyright, trademark, trade |
+secret, trade dress, patent or other intellectual property |
+right of any person or defames any person or violates their |
+rights of publicity or privacy,</li> |
+<li>any misrepresentation made by the Participant in connection |
+with the Contest;</li> |
+<li>any non-compliance by the Participant with these Terms; and</li> |
+<li>claims brought by persons or entities other than the parties |
+to these Terms arising from or related to the Participant’s |
+involvement with the Contest.</li> |
+</ol> |
+<p>To the extent permitted by law, Participant agrees to hold |
+Google, its respective directors, officers, employees and |
+assigns harmless for any injury or damage caused or claimed to |
+be caused by participation in the Contest and/or use or |
+acceptance of any prize, except to the extent that any death or |
+personal injury is caused by the negligence of Google.</p> |
+</li> |
+<li><p class="first">Elimination. Any false information provided within the context |
+of the Contest by any Participant including information |
+concerning identity, mailing address, telephone number, email |
+address, or ownership of right, or non-compliance with these |
+Terms or the like may result in the immediate elimination of the |
+Participant from the Contest. In the event an individual who is |
+a member of a team supplies information that is covered by this |
+section, the entire team shall be disqualified.</p> |
+</li> |
+<li><p class="first">Right to Cancel. If for any reason the Contest is not capable of |
+running as planned, including infection by computer virus, bugs, |
+tampering, unauthorized intervention, fraud, technical failures, |
+or any other causes which corrupt or affect the administration, |
+security, fairness, integrity, or proper conduct of the Contest, |
+Google reserves the right at its sole discretion to cancel, |
+terminate, modify or suspend the Contest.</p> |
+</li> |
+<li><p class="first">Forum and Recourse to Judicial Procedures. These Terms shall be |
+governed by, subject to, and construed in accordance with the |
+laws of the State of California, United States of America, |
+excluding all conflict of law rules. If any provision(s) of |
+these Terms are held to be invalid or unenforceable, all |
+remaining provisions hereof will remain in full force and |
+effect. To the extent permitted by law, the rights to litigate, |
+seek injunctive relief or make any other recourse to judicial or |
+any other procedure in case of disputes or claims resulting from |
+or in connection with this Contest are hereby excluded, and all |
+Participants expressly waive any and all such rights.</p> |
+</li> |
+<li><p class="first">Arbitration. By entering the Contest, you agree that exclusive |
+jurisdiction for any dispute, claim, or demand related in any |
+way to the Contest will be decided by binding arbitration. All |
+disputes between you and Google, of whatsoever kind or nature |
+arising out of these Terms, shall be submitted to Judicial |
+Arbitration and Mediation Services, Inc. (“JAMS”) for binding |
+arbitration under its rules then in effect in the San Jose, |
+California, USA area, before one arbitrator to be mutually |
+agreed upon by both parties. The parties agree to share equally |
+in the arbitration costs incurred.</p> |
+</li> |
+<li><p class="first">Winner List</p> |
+<p>You may request a list of winners after December 7th, 2009 by |
+writing to:</p> |
+<div class="line-block"> |
+<div class="line">Native Client Security Contest</div> |
+<div class="line">Google Inc.</div> |
+<div class="line">1600 Amphitheater Parkway</div> |
+<div class="line">Mountain View, CA 94043</div> |
+<div class="line">USA</div> |
+</div> |
+<p>(Residents of Vermont need not supply postage).</p> |
+</li> |
+</ol> |
+</li> |
+</ol> |
+</section> |
+ |
+{{/partials.standard_nacl_article}} |