[flagged]
Further reading: https://en.wikipedia.org/wiki/Bug_bounty_program
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
11–20 of 128 posts
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#12They should ban this or else they will get swallowed up and companies will stop working with them. The last thing I want is a bunch of llm slop sent to me faster than a human would
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#13Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?
Eventually projects who can afford the smugness are going to charge people to be able to talk to open source developers.
isnt that called enterprise support / consulting
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#14Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?
One would think if AI can generate the slop it could also triage the slop.
How does it know the difference?
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#15They should ban this or else they will get swallowed up and companies will stop working with them. The last thing I want is a bunch of llm slop sent to me faster than a human would
As long as they maintain a history per account and discourage gaming with new accounts, I don't see why anyone would want slop that performed lower just because the slop was manual. (I just had someone tell me that they wished the nonsensical bounty submissions they triaged were at least being fixed up with gpt3.)
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#16Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?
You see, the dream is another AI that reads the report and writes the issue in the bug tracker. Then another AI implements the fix. A third AI then reviews the code and approves and merges it. All without human interaction! Once CI releases the fix, the first AI can then find the same vulnerability plus a few new and exciting ones.
This is completely absurd. If generating code is reliable, you can have one generator make the change, and then merge and release it with traditional software.
If it's not reliable, how can you rely on the written issue to be correct, or the review, and so how does that benefit you over just blindly merging whatever changes are created by the model?
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#17They should ban this or else they will get swallowed up and companies will stop working with them. The last thing I want is a bunch of llm slop sent to me faster than a human would
HackerOne was already useless years before LLMs. Vulnerability scanning was already automated.
When we put our product on there, roughly 2019, the enterprising hackers ran their scanners, submitted everything they found as the highest possible severity to attempt to maximize their payout, and moved on. We wasted time triaging all the stuff they submitted that was nonsense, got nothing valuable out of the engagement, and dropped HackerOne at the end of the contract.
You'd be much better off contracting a competent engineering security firm to inspect your codebase and infrastructure.
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#18Earlier quoted context omitted.
You see, the dream is another AI that reads the report and writes the issue in the bug tracker. Then another AI implements the fix. A third AI then reviews the code and approves and merges it. All without human interaction! Once CI releases the fix, the first AI can then find the same vulnerability plus a few new and exciting ones.
This is completely absurd. If generating code is reliable, you can have one generator make the change, and then merge and release it with traditional software. If it's not reliable, how can you rely on the written issue to be correct, or the review, and so how does that benefit you over just blindly merging whatever changes are created by the model?
Making sense is not required as long as “AI” vendors sell subscriptions.
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#19> XBOW submitted nearly 1,060 vulnerabilities. Yikes, explains why my manually submitted single vulnerability is taking weeks to triage.
The XBOW people are not randos.
Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
#20They should ban this or else they will get swallowed up and companies will stop working with them. The last thing I want is a bunch of llm slop sent to me faster than a human would
HackerOne was already useless years before LLMs. Vulnerability scanning was already automated. When we put our product on there, roughly 2019, the enterprising hackers ran their scanners, submitted everything they found as the highest possible severity to attempt to maximize their payout, and moved on. We wasted time triaging all the stuff they submitted that was nonsense, got nothing valuable out of the engagement,…
Moreover, I don't think XBOW is likely generating the kind of slop beg bounty people generate. There's some serious work behind this.