Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(701)

Unified Diff: native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html

Issue 140993006: [NaCl SDK Docs] Check in the generated NaCl SDK Documentation. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: try without pepper_{dev,beta,stable} Created 6 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html
diff --git a/native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html b/native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html
new file mode 100644
index 0000000000000000000000000000000000000000..d18b617bc3cdaedd0a1d068092b9667cc7848f08
--- /dev/null
+++ b/native_client_sdk/src/doc/_developer.chrome.com_generated/community/security-contest/contest-terms.html
@@ -0,0 +1,928 @@
+{{+bindTo:partials.standard_nacl_article}}
+
+<section id="security-contest-terms-and-conditions">
+<span id="contest-terms"></span><h1 id="security-contest-terms-and-conditions"><span id="contest-terms"></span>Security Contest Terms and Conditions</h1>
+<aside class="caution">
+The Native Client Security Contest has ended&#8212;check out the
+<a class="reference internal" href="/native-client/community/security-contest/index.html#contest-winners"><em>winning submissions</em></a>. We welcome your
+continued involvement in the project. You can help by submitting
+<a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">bugs</a> and
+participating in the <a class="reference external" href="http://groups.google.com/group/native-client-discuss">Native Client discussion group</a>.
+</aside>
+<aside class="warning">
+This has been reformatted from the original, and the enumeration
+list numbering style differs from the original document.
+</aside>
+<p>NO PURCHASE NECESSARY TO ENTER OR WIN. VOID WHERE PROHIBITED. CONTEST
+IS OPEN TO RESIDENTS OF THE 50 UNITED STATES, THE DISTRICT OF COLUMBIA
+AND WORLDWIDE, EXCEPT FOR ITALY, BRAZIL, QUEBEC, CUBA, IRAN, SYRIA,
+NORTH KOREA, SUDAN AND MYANMAR.</p>
+<p>ENTRY IN THIS CONTEST CONSTITUTES YOUR ACCEPTANCE OF THESE TERMS AND
+CONDITIONS.</p>
+<ol class="upperroman">
+<li><p class="first">Binding Agreement</p>
+<p>In order to enter the Native Client Security Contest (&#8220;Contest&#8221;),
+you must agree to these Terms and Conditions (&#8220;Terms&#8221;). Therefore,
+please read these Terms prior to entry to ensure you understand and
+agree. You agree that submission of an entry in the Contest
+constitutes your agreement to these Terms. After reading the Terms
+and in order to participate, each Participant (as defined below)
+must complete the registration form, clicking the &#8220;I understand and
+agree&#8221; box (or the equivalent), on the Contest entry webpage. Once
+the Participant clicks the &#8220;I understand and agree&#8221; box (or the
+equivalent), the Terms form a binding legal agreement between each
+Participant and Google with respect to the Contest.</p>
+<p>Participants may not submit an Exploit, Issue or Summary to the
+Contest and are not eligible to receive the prizes described in
+these Terms unless they agree to these Terms. If a Participant is
+part of a team, each member of the team must read and agree to
+these Terms and click on the &#8220;I understand and agree&#8221; box (or the
+equivalent) described herein. Failure of any member of a team to
+agree to these Terms and click on the &#8220;I understand and agree&#8221; box
+(or the equivalent) described herein will disqualify the entire
+team.</p>
+<p>By entering, Participant warrants that Participant has not violated
+any employment agreement or other restriction imposed by his or her
+employer by participating in this Contest.</p>
+</li>
+<li><p class="first">Description</p>
+<p>The Contest is organized by Google and is designed to motivate the
+developer community to identify and report security Exploits (as
+defined below) on Google’s Native Client software and reward those
+developers who identify one or more security Exploits that are
+evaluated as a winning exploit by the Judges.</p>
+<p>Once a Participant has registered for the Contest, the Participant
+will be asked to identify security Exploits in Google’s Native
+Client Software and enter those Exploits on Google’s <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client
+Issue Tracker</a>
+web site using the &#8220;Security Contest Template.&#8221; At this point, the
+Exploit will become an Issue and will no longer be able to be
+identified by another Participant. Google will then verify that the
+Issue is reproducible. If so, that Issue will become a Verified
+Issue. Finally, the Participant will submit a Summary of up to his
+or her top ten best Issues that were submitted on the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native
+Client Issue Tracker</a>. Since it is
+possible that an Issue may not be verified until after the Contest
+End Date, if a Participant includes such an Issue in their Summary
+and such Issue is not ultimately verified, then that Issue will not
+be considered to be part of the Summary.</p>
+<p>Prizes will be awarded to those Participants who submit the best
+Summaries as determined in the sole discretion of the Judges when
+considering the Judging Criteria described herein.</p>
+</li>
+<li><p class="first">Sponsor</p>
+<p>The Contest is sponsored by Google Inc. (&#8220;Google&#8221; or &#8220;Sponsor&#8221;), a
+Delaware corporation with its principal place of business at 1600
+Amphitheater Parkway, Mountain View, CA, 94043, USA.</p>
+</li>
+<li><p class="first">Term</p>
+<p>The Contest begins at 9:00:00 A.M. Pacific Time (PT) Zone in the
+United States on Februrary 25th, 2009 (&#8220;Contest Start Date&#8221;) and
+ends at 11:59:59 P.M. PT on May 5th, 2009 (&#8220;Contest End
+Date&#8221;). Participants must register by May 5th, 2009 at 11:59:59
+Pacific Time to be eligible to participate. ENTRANTS ARE
+RESPONSIBLE FOR DETERMINING THE CORRESPONDING TIME ZONE IN THEIR
+RESPECTIVE JURISDICTIONS.</p>
+</li>
+<li><p class="first">Definitions</p>
+<p>Throughout these Terms, Google will use the following defined terms
+and words. Please review them carefully to ensure you understand.</p>
+<ol class="arabic simple">
+<li>Covert Channel Attack: A &#8220;Covert Channel Attack&#8221; means an
+attempt to manipulate certain properties of a communications
+medium in an unexpected, unconventional, or unforeseen way in
+order to transmit information through the medium without
+detection by anyone other than the entities operating the covert
+channel. Exploits that are Covert Channel Attacks are excluded
+from the Contest.</li>
+<li>Exploit: An &#8220;Exploit&#8221; means a sequence of steps that require and
+use Native Client to produce or have the potential to produce
+behavior prohibited by Native Client&#8217;s security policies and
+design which can be found at
+<a class="reference external" href="http://src.chromium.org/viewvc/native_client/trunk/src/native_client/README.html">http://src.chromium.org/viewvc/native_client/trunk/src/native_client/README.html</a>.
+Google reserves the right to modify the security policies and
+design at any time. An example of an Exploit would be producing
+file system or network access outside of the scope of
+permissible use via JavaScript in a browser. An Exploit that
+defeats one but not all Native Client security measures is still
+considered to produce behavior prohibited by Native Client&#8217;s
+security policies for the purposes of this Contest and would be
+entitled to be identified as an Exploit in the Contest.</li>
+<li>Inner Sandbox: The &#8220;Inner Sandbox&#8221; means the Native Client
+security system that a) inspects executables before running them
+to try to detect the potential for an executable to produce
+prohibited behavior, and b) prevents from running any
+executables that are detected to have the potential to produce
+prohibited behavior.</li>
+<li>Issue: An &#8220;Issue&#8221; means an entry of a single Exploit by a
+Participant into the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a> using a
+properly filled out Security Contest Template. Once the Exploit
+has been properly entered it becomes an Issue.</li>
+<li>Native Client Issue Tracker: The &#8220;Native Client Issue Tracker&#8221;
+is located at
+<a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">http://code.google.com/p/nativeclient/issues/list</a>. It is a web
+application that manages and maintains a list of Issues,
+including Issues that are not eligible for contest entry.</li>
+<li>Native Client Version Number: The &#8220;Native Client Version Number&#8221;
+is defined as the number between the platform name (separated by
+an &#8216;_&#8217;) and the file extension (separated by a &#8216;.&#8217;) in the
+Native Client download. For example, if the the filename of the
+download on the Native Client download page is
+&#8220;nacl_linux_0.1_32_2009_01_16.tgz&#8221; or
+&#8220;nacl_windows_0.1_32_2009_01_16.zip&#8221;, the Version Number is
+&#8220;0.1_32_2009_01_16&#8221;.</li>
+<li>Outer Sandbox: The &#8220;Outer Sandbox&#8221; means the Native Client
+security system that 1) observes executables while they are
+running to detect the attempts at prohibited behavior and 2)
+terminates misbehaving executables if it observes any attempts
+to produce prohibited behavior.</li>
+<li>Participant: A &#8220;Participant&#8221; means any individual or team of
+individuals that has agreed to these Terms, meets the
+eligibility criteria described below, and is participating in
+the Contest.</li>
+<li>Side Channel Attack: A &#8220;Side Channel Attack&#8221; means any attack
+based on information gained as a side-effect of the
+implementation of a cryptosystem, rather than brute force or
+theoretical weaknesses in the algorithms. For example, attacks
+that use timing information, power consumption variation,
+electromagnetic leaks or sound to obtain information illicitly
+are side channel attacks. Exploits that are Side Channel Attacks
+are excluded from the Contest.</li>
+<li>Summary: A &#8220;Summary&#8221; means the final electronic document
+complying with the requirements of Section X that each
+Participant must submit in order to participate in the
+Contest. A Summary may contain up to 10 Issues. If Issues do not
+ultimately become Verified Issues, they will not be considered
+as part of the Summary and Participant understands and accepts
+the risk that if the Participant identified an Issue on a
+Summary that had not yet been verified, that Issue will not be
+considered as part of the Summary if not subsequently verified.</li>
+<li>Verified Issue: A &#8220;Verified Issue&#8221; means an Exploit that has
+been a) submitted to the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a> in
+accordance with these Terms, and b) confirmed by the Native
+Client team at Google to exhibit the behavior described in the
+Issue report.</li>
+</ol>
+</li>
+<li><p class="first">Eligibility</p>
+<p>The Contest is open to Participants who (1) have agreed to these
+Terms; (2) who are of or above the legal age of majority, at the
+time of entry, to form valid contracts in their respective country,
+province or state of legal residence (and at least the age of 20 in
+Taiwan); (3) are not residents of Italy, Brazil, Quebec, Cuba,
+Iran, Syria, North Korea, Sudan, or Myanmar; and (4) who have
+software development experience. Sponsor reserves the right to
+verify eligibility and to adjudicate on any dispute at any
+time. The Contest is void in, and not open to residents of, Italy,
+Brazil, Quebec, Cuba, Iran, Syria, North Korea, Sudan, Myanmar, or
+to individuals and entities restricted by U.S. export controls and
+sanctions, and is void in any other nation, state, or province
+where prohibited or restricted by U.S. or local law.</p>
+<p>Employees and contractors of Google, affiliates and subsidiaries of
+Google, the Judges and members of their immediate families (defined
+as parents, children, siblings and spouse, regardless of where they
+reside and/or those living in the same household of each) are not
+eligible to participate in the Contest. Judges may not help any
+Participant with their submissions and Judges must recuse
+themselves in cases where they have a conflict of interest that
+becomes known to the Judge.</p>
+</li>
+<li><p class="first">Registration &amp; Entry Process</p>
+<ol class="arabic">
+<li><p class="first">All Participants must register at
+code.google.com/contests/nativeclient-security/ by May 5th, 2009
+at 11:59:59 Pacific Time. All individuals participating in the
+Contest (either as an individual Participant or as a member of a
+team) must provide the following registration information:</p>
+<ol class="loweralpha simple">
+<li>Email Address(es) of the Participant. The first member of a
+team to register must list the email addresses of all
+members of the Participant team, and all members must
+ultimately agree to the Terms as described more fully below.</li>
+<li>Nationality and primary place of residence of the Participant.</li>
+<li>If the Participant is a team, the email address of the team
+member who is selected to be the recipient of the prize. The
+first member of the team to register will designate this
+information in the initial team registration.</li>
+<li>Participant name, which is the team name in the case of a
+team or the user name chosen by an individual in the case of
+an individual Participant.</li>
+</ol>
+<p>Failure to fully, completely and accurately provide this
+information will disqualify the Entry.</p>
+</li>
+<li><p class="first">Any potential prize recipient may be required to show proof of
+being the authorized account holder for an email address. The
+&#8220;Authorized Account Holder&#8221; is the natural person assigned to an
+email address by the relevant provider of email services.</p>
+</li>
+<li><p class="first">Participants that are teams must provide the above registration
+information for every individual who is a member of the
+team. Every individual who is part of the team must agree to the
+Terms in order for the team to be eligible to participate by
+clicking the &#8220;I understand and agree&#8221; box (or the equivalent) on
+the Contest entry webpage. Members of a team will be able to
+edit the information relating to the team only until the last
+member of the team has accepted these Terms by clicking the &#8220;I
+understand and agree&#8221; box (or the equivalent) on the Contest
+entry webpage. Issues submitted by members of a team prior to
+the time that all individual members of the team have clicked
+the &#8220;I understand and agree&#8221; box (or the equivalent) will not be
+valid Issue submissions and will not be eligible entries in the
+Contest. Google will send an email to all members of the team
+when the final team member has accepted the terms, however
+Google will have no liability for failure to send such an email
+or for the failure of any team member to receive the email.</p>
+</li>
+<li><p class="first">Issues submitted by Participants who are individuals prior to
+the time that the individual has clicked the &#8220;I understand and
+agree&#8221; box (or the equivalent) will not be valid Issue
+submissions and will not be eligible entries in the
+Contest. Google will send an email to the individual when the
+individual has accepted the terms, however Google will have no
+liability for failure to send such an email or for the failure
+of any team member to receive the email.</p>
+</li>
+<li><p class="first">All entries become the property of Sponsor and will not be
+acknowledged or returned. Entries are void if they are in whole
+or part illegible, incomplete, damaged, altered, counterfeit,
+obtained through fraud, or late.</p>
+</li>
+<li><p class="first">LIMIT ONE ENTRY PER PERSON. Individuals may only enter one time,
+whether as an individual Participant or as a team
+Participant. Google, in its sole discretion, may disqualify any
+Participant (including team Participants) that it believes has
+violated this provision.</p>
+</li>
+</ol>
+</li>
+<li><p class="first">Submission Process</p>
+<ol class="arabic simple">
+<li>Each Participant must submit:<ol class="loweralpha">
+<li>At least one Issue in the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a> that
+describes an Exploit and includes the information detailed
+in the &#8220;Issues&#8221; section below. Any team member can submit an
+Issue on behalf of the team. All entries will be deemed made
+by the Authorized Account Holder of the email address
+submitted at the time of entry.</li>
+<li>One Summary per Participant that includes the information
+detailed in the &#8220;Summary&#8221; section below. Participant will be
+entitled to amend its Summary until the Contest End Date and
+only the last version will be considered by the Judges.</li>
+</ol>
+</li>
+<li>Each Issue must be written in the English language. Google or
+the Judges may refuse to review submissions that they deem
+incomprehensible, include Issues that are not repeatable as
+determined by Google, or that otherwise do not meet the
+requirements of these Terms.</li>
+<li>To enter an Issue in the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a>, each
+Participant must use the &#8220;Security Contest Template&#8221; and provide
+completely and accurately all information requested by the
+template. Any Issues that are not entered with the &#8220;Security
+Contest Template&#8221; may not be considered by the Judges. Each
+Issue must contain the items described in the &#8220;Issues&#8221; section
+of these Terms.</li>
+</ol>
+</li>
+<li><p class="first">Issues</p>
+<ol class="arabic simple">
+<li>Minimum requirements for Issues: Participant must identify an
+Exploit and enter the Exploit into the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue
+Tracker</a>. Once the
+Exploit is submitted it becomes an Issue. Each submitted Issue
+must include (i) the following information and (ii) all
+additional information requested on the &#8220;Security Contest
+Template&#8221;:<ol class="loweralpha">
+<li>The user name (in the case of Individual Participants) or
+the team name (in the case of team Participants) of the
+Participant submitting the Issue, which must be identical to
+the user name or team name submitted during the registration
+process.</li>
+<li>A gzipped tar archive (with paths relative to
+nacl/googleclient/native_client/tests/) that contains any
+instructions and files necessary to reproduce the Exploit,
+which must include:<ol class="arabic">
+<li>A README.txt file that describes:<ul class="small-gap">
+<li>The version number of current version of Native Client
+at the time of submission. Issues submitted with a
+version number listed other than the current version
+at the time of submission will be invalid;</li>
+<li>The steps required to reproduce the Exploit;</li>
+<li>The effect of the Exploit; and</li>
+<li>Platform requirements for the Exploit, including but
+not necessarily limited to:</li>
+<li>browser version;</li>
+<li>operating system name(s) and version(s); and/or</li>
+<li>any other platform requirements relevant to the Exploit.</li>
+</ul>
+</li>
+<li>If the Exploit requires a binary executable, both the
+source code and binary executable must be provided upon
+creation of the Issue. Any subsequent updates to the
+source code or binary executable after the creation of
+the Issue will not be considered for the purposes of
+this Contest. The binary executable must build cleanly
+by executing the command &#8220;make&#8221; in the exploit directory
+(e.g. nacl/googleclient/native_client/tests/exploit1).</li>
+</ol>
+</li>
+</ol>
+</li>
+<li>Verified Issues: In order for an Issue to become a Verified
+Issue, Google will first examine the submitted Issue to
+determine whether it complies with the following:<ol class="loweralpha">
+<li>The Exploit must not contain or depend upon access or use of
+any third party software or code that Google does not have
+readily available to it or that would require complying with
+third party license agreement that Google in its sole
+discretion deems onerous or burdensome.</li>
+<li>Google must be able to replicate the Exploit in its sole
+discretion.</li>
+<li>The Exploit must affect at least one &#8220;opt-&#8221; platform from a
+standard build of the most recent released version of Native
+Client as of the time of submission of the Issue for the
+Exploit.</li>
+</ol>
+</li>
+<li>Timeliness<ol class="loweralpha">
+<li>If the vulnerability exposed by the submitted Exploit was
+disclosed in a previously reported Issue (whether or not
+submitted by a Participant) or in the previously published
+Native Client release notes, the submission will be invalid
+for the purposes of this Contest. Two Exploits are
+considered to expose the same vulnerability if the
+theoretical patch required to fix one vulnerability also
+fixes the second vulnerability.</li>
+<li>Google will update the Native Client source code base at
+most twice per week. These updates, if they occur, will
+appear Mondays and Thursdays between 3 p.m. and 8
+p.m. Pacific Time.</li>
+<li>Issues will not be valid if they have been entered before
+the later of (i) the Contest Start Date or (ii) the time at
+which all members of a team Participant or the individual
+Participant, as the case may be, have accepted these Terms.</li>
+</ol>
+</li>
+<li>Excluded Exploits. The following types of Exploits are invalid
+for the purposes of this Contest:<ul class="small-gap">
+<li>Covert Channel Attacks;</li>
+<li>Sidechannel Attacks;</li>
+<li>Exploits requiring a virtualized CPU;</li>
+<li>Exploits that rely on features, misfeatures or defects of
+virtual machines (i.e. VMWare, Xen, Parallels etc.);</li>
+<li>Exploits that require the machine to be previously compromised
+by malicious software (including but not limited to viruses or
+malware); and</li>
+<li>Exploits that rely on hardware failures, other than Exploits
+which, in Google’s sole judgment, depend on CPU errata but
+which can be reproduced reliably with a common system
+configuration and under normal operating conditions, or
+statistically improbable hardware behaviors. Examples include
+but are not limited to Exploits that rely on memory errors
+induced by cosmic radiation, and Exploits that require
+abnormal heating, cooling or other abnormal physical
+conditions.</li>
+</ul>
+</li>
+<li>Completeness. Issues submitted that lack any of the above
+materials or fail to meet any of the above criteria, may not be
+considered in the judging process at Google&#8217;s sole
+discretion. Issues that are not included in a Participant
+Summary (see section below) will not be considered.</li>
+</ol>
+</li>
+<li><p class="first">Summary</p>
+<ol class="arabic simple">
+<li>Every Participant must submit a Summary at the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client
+Issue Tracker</a> complying
+with the requirements of this section. The Participant must
+select no more than 10 of the Verified Issues submitted by the
+Participant for inclusion on the Summary. Each Summary must be
+in English and must contain the following information:<ul class="small-gap">
+<li>The Issues must be listed in descending order of severity, as
+determined by the Participant in accordance with the Judging
+Criteria.</li>
+<li>Each Issue listed in the Summary must be identified by ID
+number of the Issue. The ID number is the identifying number
+created for each Issue as listed on the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue
+Tracker</a>.</li>
+<li>A description of the effect of each Exploit.</li>
+<li>The platform requirements of each Exploit.</li>
+<li>The version number(s) of Native Client software affected by
+each Exploit (which must be the version number of the Native
+Client software current at the time the Issue was submitted to
+the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue Tracker</a>).</li>
+<li>Any other details about the Exploit and the submission that
+are relevant to the judging criteria, such as, for example,
+the approach used in finding the exploits, innovative or
+scalable techniques used to discover exploits, or
+architectural analysis.</li>
+<li>The team name or user name of the Participant. Google may, in
+its sole discretion, eliminate or disqualify any Summary that
+lists user names or team names that are not identical to the
+user name or team name of the Participant listed on the
+Contest entry form.</li>
+</ul>
+</li>
+<li>Each Summary must be a maximum of 8 pages long, in PDF format
+viewable with Adobe Reader version 9. The Summary must be
+formatted for 8.5 inches x11 inches or A4 paper, with a minimum
+font size of 10 pt. Any submission that does not meet these
+formatting criteria may be disqualified at the sole discretion
+of Google.</li>
+<li>All Issues listed in the Summary will be verified by Google
+before submission of the Summary to the Judges after the Contest
+Closing Date. Participants may submit or resubmit their Summary
+at any time during the duration of the Contest, however, the
+Judges will consider only the last Summary from each Participant
+prior to the Contest Closing Date and ignore all other Summaries
+previously submitted by the Participant.</li>
+</ol>
+</li>
+<li><p class="first">Judging</p>
+<ol class="arabic">
+<li><p class="first">After the Contest End Date and on or about May 15th, 2009, all
+submitted Summaries will be judged by one of at least three
+panels with a minimum of three experts in the field of online
+security (&#8220;Judges&#8221;) on each panel. Judges will evaluate each
+Summary in accordance with the Judging Criteria described
+below. Each panel will evaluate a number of the submitted
+Summaries using the Judging Criteria described below and will
+select the highest ranking Summaries to move to the next level
+of judging. During the first round of judging, each panel will
+select no more than ten Summaries to move forward to the second
+round of judging unless there is a tie between or among any
+Participants. During the second round of judging, those
+Summaries selected during the first round of judging will then
+be evaluated by all Judges using the below Judging Criteria and
+the top five Summaries will be selected as potential
+winners. All decisions of the Judges are final and binding.</p>
+</li>
+<li><p class="first">Judging Criteria. The Judges will consider each Summary under
+following judging criteria (&#8220;Judging Criteria&#8221;):</p>
+<ol class="loweralpha">
+<li><p class="first">Quality of Exploit. Quality will be decided by the Judges in
+their sole discretion and will be based on (in order of
+importance to the Judges) Severity, Scope, Reliability and
+Style.</p>
+<ol class="lowerroman">
+<li><p class="first">Severity: the more disruptive the effects of the
+Exploit, the higher its quality. Here is a
+non-exhaustive ranking of the most common Exploits
+starting from &#8216;minor&#8217; to &#8216;severe&#8217;:</p>
+<ul class="small-gap">
+<li><p class="first">Browser crash;</p>
+</li>
+<li><p class="first">Denial of service or machine crash;</p>
+</li>
+<li><p class="first">Compromise of the Outer Sandbox;</p>
+</li>
+<li><p class="first">Information leak (such as of a cookie or password);</p>
+</li>
+<li><p class="first">Compromise of both the Inner and Outer Sandbox; and/or</p>
+</li>
+<li><p class="first">Prohibited side effect (such as reading or writing
+files to the client machine), escalation of privilege
+(such as executing other programs outside of Native
+Client).</p>
+</li>
+</ul>
+<p>Any Exploit that does not address the above elements
+will be evaluated on a case-by-case basis and the
+severity of such Exploits will be determined solely at
+the Judge’s discretion.</p>
+</li>
+<li><p class="first">Scope: the more computers that an Exploit would
+potentially affect, the bigger its scope and therefore
+higher the quality of the Exploit. Consider the
+following:</p>
+<ul class="small-gap">
+<li><p class="first">Exploits that affect all platforms supported by Native
+Client (where platform is defined as a browser,
+operating system and hardware combination) have higher
+quality than an Exploit specific to a particular
+platform.</p>
+</li>
+<li><p class="first">Exploits that require non-current or beta versions
+(historic or future) of hardware or software are lower
+quality.</p>
+</li>
+<li><p class="first">Exploits that rely on concurrent usage of other
+installed software or web content must make a
+compelling case about the likelihood of the
+prerequisite software or content being present, or
+they will be considered of lower quality.</p>
+</li>
+</ul>
+</li>
+<li><p class="first">Reliability: The more frequent or probable the
+occurrence identified by the Exploit, the more
+&#8220;reliable&#8221; it may be. Consider the following:</p>
+<ul class="small-gap">
+<li><p class="first">Exploits that require uncommon software to be
+installed on the machine in order to function will be
+deemed to have lower quality.</p>
+</li>
+<li><p class="first">Entries that include Exploits that cannot be
+reproduced 100% of the time, but which can be
+reproduced a significant percentage of the time, will
+be deemed to have a lower quality to account for a
+lowered probability that the attack will succeed.</p>
+</li>
+</ul>
+</li>
+<li><p class="first">Style: Submissions that demonstrate exceptional style
+will receive a higher ranking. Factors that contribute
+to style include:</p>
+<ul class="small-gap">
+<li><p class="first">Ingenuity in mechanism used to bypass security;</p>
+</li>
+<li><p class="first">Uniqueness of the Exploit;</p>
+</li>
+<li><p class="first">Ingenuity in methods used to discover vulnerabilities;
+and/or Minimal size of Exploit to achieve the effect.</p>
+</li>
+</ul>
+</li>
+</ol>
+</li>
+<li><p class="first">the Quantity of Exploits: Participants that submit more
+Exploits in their Summary (but no more than 10) may receive
+a higher ranking, weighted by quality. However, it is still
+possible that a Participant who submits one Exploit could
+still outweigh a Participant that submits several Exploits.</p>
+</li>
+</ol>
+<p>Considering each of the factors described above, the Judges will
+give each Summary a &#8220;Score&#8221; from 1-10 that represents the Judges
+evaluation of the Summary. This &#8220;score&#8221; will determine which
+participants move from the first round of judging to the second
+round of judging, and which participants will be selected as a
+winner.</p>
+</li>
+<li><p class="first">Winner Selection</p>
+<p>Judges will review the Summaries as discussed in the &#8220;Judging&#8221;
+section, above. The Summaries with the five (5) highest scores
+will be selected as potentially winning Participants. In the
+event of a tie ranking for two or more Summaries, the
+Participant whose Summary had the highest ranking for &#8220;Severity&#8221;
+will receive the higher prize. In the event of a second tie, the
+Participant whose Summary had the highest ranking for &#8220;Scope&#8221;
+will receive the higher prize. Odds of winning depend on the
+number of eligible entries received and the skill of the
+Participants.</p>
+<p>The Judges are under no obligation to provide feedback on their
+decisions or on their judgment on specific Exploits they
+consider.</p>
+</li>
+<li><p class="first">Team Winners</p>
+<p>A special note about the prize distribution process for
+Participants who are entering as part of a team:</p>
+<p>A single member of each team shall be designated to receive the
+prize, if any, awarded to such team at the initial registration
+of the team, and Google shall have no responsibility for
+distribution of the prize among the team members.</p>
+<p>Each individual that enters as part of a team, understands and
+agrees that if his/her team is selected to receive a prize, the
+team is responsible for ensuring the funds are appropriately
+distributed to each member of the team. In addition, once a team
+has registered, the team may not add, remove, or substitute any
+members or otherwise change the composition of the team for the
+duration of the Contest. If any member of a team does not comply
+with these Terms, is ineligible or is disqualified, the team as
+a whole may be disqualified in Google’s sole discretion.</p>
+</li>
+</ol>
+</li>
+<li><p class="first">Prizes</p>
+<ol class="arabic">
+<li><p class="first">Information Required for Eligibility</p>
+<ol class="loweralpha simple">
+<li>On or about May 15th 2009 and upon selection of potential
+winners, Google will contact all winning Participants using
+the email addresses submitted at registration. In order to
+win the Contest and receive prizes, Participants, including
+each individual on a team, must provide additional
+information including:<ul class="small-gap">
+<li>first and last name;</li>
+<li>address;</li>
+<li>phone number; and</li>
+<li>all other necessary information required by the US tax and
+legal authorities and /or the authorities of the countries
+they reside in.</li>
+</ul>
+</li>
+<li>All Participants will need to verify their identity with
+Google, before receiving their prize; however, Participants
+may provide an alias for use in any public documentation and
+marketing material issued publicly by Google, subject to
+limitations of the law and as required by law
+enforcement. Please be aware that in some jurisdictions, a
+list of winners must be made available and your name, and
+not the alias, will be provided on that list. If a
+Participant, or in the case of a team, any individual member
+of the team, refuses or fails to provide the necessary
+information to Google within 14 days of the Contest
+administrators&#8217; request for the required information, then
+Google may, in its sole discretion, disqualify the
+Participant&#8217;s entry and select as an alternative potential
+winner the Participant with the next highest overall
+ranking. Google will not be held responsible for any failure
+of potential winners to receive notification that they are
+potential winners. Except where prohibited by law, each
+potential winner may be required to sign and return a
+Declaration of Eligibility, Liability &amp; Publicity Release
+and Release of Rights and provide any additional information
+that may be required by Google. If required, potential
+winners must return all such required documents within 14
+calendar days following attempted notification or such
+potential winner will be deemed to have forfeited the prize
+and Google will select the Participant with the next highest
+overall ranking as the potential winner.</li>
+<li>Prizes will be awarded within 6 months after the Contest End Date.</li>
+<li>If fewer than 5 Participants or teams are found eligible,
+fewer than 5 winners will be selected.</li>
+<li>Prizes are not transferable or substitutable, except by
+Google in its sole discretion in the event a prize becomes
+unavailable for any reason. In such an instance, Google will
+award a prize of equal or greater value.</li>
+<li>LIMIT: Only one prize per Participant.</li>
+</ol>
+</li>
+<li><p class="first">Prize Amounts and Announcement</p>
+<p>Provided that the Participant has complied with these Terms,
+eligible Participants that are ranked in the top 5 positions of
+the competition by Judges will receive the following awards in
+U.S. Dollars based on their rank: 1st prize: $8,192.00, 2nd
+prize: $4,096.00, 3rd prize: $2,048.00, 4th prize: $1,024.00,
+5th prize: $1,024.00. Winning Entries will be announced on or
+about December 7th.</p>
+</li>
+<li><p class="first">Distribution of a Prize</p>
+<p>Google is not responsible for any division or distribution of
+the prizes among or between team members. Distribution or
+division of the prize among individual team members is the sole
+responsibility of the participating team. Google will award the
+prize only to the one (1) member of the team, who was identified
+by the Participant to receive the prize as part of the
+registration process. Google will attempt to reach only the
+designated recipient for purposes of distribution of the prize.</p>
+<p>Prizes are awarded without warranty of any kind from Google,
+express or implied, without limitation, except where this would
+be contrary to federal, state, provincial, or local laws or
+regulations. All federal, state, provincial and local laws and
+regulations apply.</p>
+</li>
+<li><p class="first">Taxes</p>
+<p>Payments to potential prize winners are subject to the express
+requirement that they submit to Google all documentation
+requested by Google to permit it to comply with all applicable
+US, state, local and foreign (including provincial) tax
+reporting and withholding requirements. All prizes will be net
+of any taxes Google is required by law to withhold. All taxes
+imposed on the prize are the sole responsibility of the prize
+recipient.</p>
+<p>In order to receive a prize, potential prize recipients must
+submit the tax documentation requested by Google or otherwise
+required by applicable law, to Google or the relevant tax
+authority, all as determined by applicable law, including, where
+relevant, the law of the potential prize recipient&#8217;s country of
+residence. The potential prize recipient is responsible for
+ensuring that (s)he complies with all the applicable tax laws
+and filing requirements. If a potential prize recipient fails to
+provide such documentation or comply with such laws, the prize
+may be forfeited and Google may, in its sole discretion, select
+an alternative potential prize recipient.</p>
+</li>
+</ol>
+</li>
+<li><p class="first">General Conditions</p>
+<ol class="arabic">
+<li><p class="first">Right to Disqualify. A Participant may be prohibited from
+participating in or be disqualified from this Contest if, in
+Google&#8217;s sole discretion, it reasonably believes that the
+Participant or any member of a Participant team has attempted to
+undermine the legitimate operation of the Contest by cheating,
+deception, or other unfair playing practices or annoys, abuses,
+threatens or harasses any other Participants, Google, or the
+Judges. Google further reserves the right to disqualify any
+Issue that it believes in its sole and unfettered discretion
+infringes upon or violates the rights of any third party,
+otherwise does not comply with these Terms, or violates U.S. or
+applicable local law in Participant&#8217;s country of residence.</p>
+<p>Google further reserves the right to disqualify any Participant
+who tampers with the submission process or any other part of the
+Contest. Any attempt by a Participant to deliberately damage any
+web site or undermine the legitimate operation of the Contest is
+a violation of criminal and civil laws and should such an
+attempt be made, Google reserves the right to seek damages from
+any such Participant to the fullest extent of the applicable
+law.</p>
+</li>
+<li><p class="first">Internet Disclaimer. Google is not responsible for any
+malfunction of the entire Contest, the web site displaying the
+Contest terms and entry information, or any late, lost, damaged,
+misdirected, incomplete, illegible, undeliverable, or destroyed
+Exploits, Issues or Summaries due to system errors, failed,
+incomplete or garbled computer or other telecommunication
+transmission malfunctions, hardware or software failures of any
+kind, lost or unavailable network connections, typographical or
+system/human errors and failures, technical malfunction(s) of
+any telephone network or lines, cable connections, satellite
+transmissions, servers or providers, or computer equipment,
+traffic congestion on the Internet or at the web site displaying
+the Contest or any combination thereof, including other
+telecommunication, cable, digital or satellite malfunctions
+which may limit an entrant’s ability to participate. Google is
+not responsible for availability of the <a class="reference external" href="http://code.google.com/p/nativeclient/issues/list">Native Client Issue
+Tracker</a>
+from your preferred point of Internet access. In the event of a
+technical disruption, Google may, in its sole discretion, extend
+the Contest End Date for a reasonable period. Google will
+attempt to notify Participants of any such extension by email at
+the email address in the registration information, but shall
+have no liability for any failure of such notification.</p>
+</li>
+<li><p class="first">Exploits Independently Discovered by Google. You acknowledge and
+understand that Google may discover Exploits independently that
+may be similar to or identical to your Issues in terms of
+function, vulnerability, or in other respects. You agree that
+you will not be entitled to any rights in, or compensation in
+connection with, any such similar or identical applications
+and/or ideas. You acknowledge that you have submitted your entry
+voluntarily and not in confidence or in trust.</p>
+</li>
+<li><p class="first">No Contract for Employment. You acknowledge that no
+confidential, fiduciary, agency or other relationship or
+implied-in-fact contract now exists between you and Google and
+that no such relationship is established by your submission of
+an entry to Google in this Contest. Under no circumstances shall
+the submission of an entry in the Contest, the awarding of a
+prize, or anything in these Terms be construed as an offer or
+contract of employment with Google.</p>
+</li>
+<li><p class="first">Intellectual Property Rights and License. Participants warrant
+that their Exploit and Summary are their own original work and,
+as such, they are the sole and exclusive owner and rights holder
+of the submitted Exploit and Summary and that they have the
+right to submit the Exploit and Summary in the Contest and grant
+all required licenses. Each Participant agrees not to submit any
+Exploit and Summary that (a) infringes any third party
+proprietary rights, intellectual property rights, industrial
+property rights, personal or moral rights or any other rights,
+including without limitation, copyright, trademark, patent,
+trade secret, privacy, publicity or confidentiality obligations;
+or (b) otherwise violates the applicable state, federal,
+provincial or local law.</p>
+<p>As between Google and the Participant, the Participant retains
+ownership of all intellectual and industrial property rights in
+and to the Issues and Summary that Participant created. As a
+condition of entry, Participant grants Google a perpetual,
+irrevocable, worldwide, royalty-free, and non-exclusive license
+to use, reproduce, publicly perform, publicly display,
+distribute, sublicense and create a derivative work from, any
+Issue or Summary that Participant submits to this Contest for
+the purposes of allowing Google to test, evaluate and fix or
+remedy the Issue and Summary for purposes of the Contest and
+modifying or improving the Native Client software or any other
+current or future Google product or service.</p>
+<p>Participant also grants Google the right to reproduce and
+distribute the Issue and the Summary. In addition, Participant
+specifically agrees that Google shall have the right to use,
+reproduce, publicly perform, and publicly display the Issue and
+Summary in connection with the advertising and promotion of the
+Native Client software or any other current or future Google
+product or service via communication to the public or other
+groups, including, but not limited to, the right to make
+screenshots, animations and video clips available for
+promotional purposes.</p>
+</li>
+<li><p class="first">Privacy. Participants agree that personal data provided to
+Google during the Contest, including name, mailing address,
+phone number, and email address may be processed, stored, and
+otherwise used for the purposes and within the context of the
+Contest. This data will be maintained in accordance with the
+Google Privacy Policy found at
+<a class="reference external" href="http://www.google.com/privacypolicy.html">http://www.google.com/privacypolicy.html</a>. This data will also be
+transferred into the United States. By entering, Participants
+agree to the transmission, processing, and storage of this
+personal data in the United States.</p>
+<p>Participants also understand this data may be used by Google in
+order to verify a Participant&#8217;s identity, postal address and
+telephone number in the event a Participant qualifies for a
+prize. Participants have the right to access, review, rectify or
+cancel any personal data held by Google in connection with the
+Contest by writing to Google at the address listed below in the
+section entitled &#8220;Winner’s List.&#8221;</p>
+<p>For residents of the European Union:</p>
+<p>Pursuant to EU law pertaining to data collection and processing,
+you are informed that:</p>
+<ul class="small-gap">
+<li><p class="first">The data controller is Google and the data recipients are
+Google and its agents;</p>
+</li>
+<li><p class="first">Your data is collected for purposes of administration of the
+Native Client Security Contest;</p>
+</li>
+<li><p class="first">You have a right of access to and withdrawal of your personal
+data. You also have a right of opposition to the data
+collection, under certain circumstances. To exercise such
+right, You may write to: Native Client Security Contest,
+Google Inc., 1600 Amphitheater Parkway, Mountain View, CA
+94043, USA.</p>
+</li>
+<li><p class="first">Your personal data will be transferred to the U.S.</p>
+</li>
+</ul>
+</li>
+<li><p class="first">Indemnity. To the maximum extent permitted by law, each
+Participant indemnifies and agrees to keep indemnified Google
+and Judges at all times from and against any liability, claims,
+demands, losses, damages, costs and expenses resulting from any
+act, default or omission of the Participant and/or a breach of
+any warranty set forth herein. To the maximum extent permitted
+by law, each Participant agrees to defend, indemnify and hold
+harmless Google, its affiliates and their respective directors,
+officers, employees and agents from and against any and all
+claims, actions, suits or proceedings, as well as any and all
+losses, liabilities, damages, costs and expenses (including
+reasonable attorneys fees) arising out of or accruing from:</p>
+<ol class="loweralpha simple">
+<li>any material uploaded or otherwise provided by the
+Participant that infringes any copyright, trademark, trade
+secret, trade dress, patent or other intellectual property
+right of any person or defames any person or violates their
+rights of publicity or privacy,</li>
+<li>any misrepresentation made by the Participant in connection
+with the Contest;</li>
+<li>any non-compliance by the Participant with these Terms; and</li>
+<li>claims brought by persons or entities other than the parties
+to these Terms arising from or related to the Participant&#8217;s
+involvement with the Contest.</li>
+</ol>
+<p>To the extent permitted by law, Participant agrees to hold
+Google, its respective directors, officers, employees and
+assigns harmless for any injury or damage caused or claimed to
+be caused by participation in the Contest and/or use or
+acceptance of any prize, except to the extent that any death or
+personal injury is caused by the negligence of Google.</p>
+</li>
+<li><p class="first">Elimination. Any false information provided within the context
+of the Contest by any Participant including information
+concerning identity, mailing address, telephone number, email
+address, or ownership of right, or non-compliance with these
+Terms or the like may result in the immediate elimination of the
+Participant from the Contest. In the event an individual who is
+a member of a team supplies information that is covered by this
+section, the entire team shall be disqualified.</p>
+</li>
+<li><p class="first">Right to Cancel. If for any reason the Contest is not capable of
+running as planned, including infection by computer virus, bugs,
+tampering, unauthorized intervention, fraud, technical failures,
+or any other causes which corrupt or affect the administration,
+security, fairness, integrity, or proper conduct of the Contest,
+Google reserves the right at its sole discretion to cancel,
+terminate, modify or suspend the Contest.</p>
+</li>
+<li><p class="first">Forum and Recourse to Judicial Procedures. These Terms shall be
+governed by, subject to, and construed in accordance with the
+laws of the State of California, United States of America,
+excluding all conflict of law rules. If any provision(s) of
+these Terms are held to be invalid or unenforceable, all
+remaining provisions hereof will remain in full force and
+effect. To the extent permitted by law, the rights to litigate,
+seek injunctive relief or make any other recourse to judicial or
+any other procedure in case of disputes or claims resulting from
+or in connection with this Contest are hereby excluded, and all
+Participants expressly waive any and all such rights.</p>
+</li>
+<li><p class="first">Arbitration. By entering the Contest, you agree that exclusive
+jurisdiction for any dispute, claim, or demand related in any
+way to the Contest will be decided by binding arbitration. All
+disputes between you and Google, of whatsoever kind or nature
+arising out of these Terms, shall be submitted to Judicial
+Arbitration and Mediation Services, Inc. (&#8220;JAMS&#8221;) for binding
+arbitration under its rules then in effect in the San Jose,
+California, USA area, before one arbitrator to be mutually
+agreed upon by both parties. The parties agree to share equally
+in the arbitration costs incurred.</p>
+</li>
+<li><p class="first">Winner List</p>
+<p>You may request a list of winners after December 7th, 2009 by
+writing to:</p>
+<div class="line-block">
+<div class="line">Native Client Security Contest</div>
+<div class="line">Google Inc.</div>
+<div class="line">1600 Amphitheater Parkway</div>
+<div class="line">Mountain View, CA 94043</div>
+<div class="line">USA</div>
+</div>
+<p>(Residents of Vermont need not supply postage).</p>
+</li>
+</ol>
+</li>
+</ol>
+</section>
+
+{{/partials.standard_nacl_article}}

Powered by Google App Engine
This is Rietveld 408576698