Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Death by a Thousand Slops

daniel.haxx.se

Post reply on HN
Print view View original

71–80 of 149 posts

Re: Death by a Thousand Slops

#71

Post by jannes »

armchairhacker wrote: post #60

You could charge a fee and give the money back if the report is wrong but seems well-intentioned. I see the issue with this, it's payment platforms. Despite the hate, cryptocurrency seems like it could be a solution. But in practice, people won't take time to set up a crypto wallet just to submit a bug report, and if crypto becomes popular, it may get regulations and middlemen like fiat (which add friction, e.g. char…

This is probably something that the platform HackerOne should implement. It can't be addressed on the project level.

https://hackerone.com/curl/hacktivity

Re: Death by a Thousand Slops

#72

Post by AStonesThrow »

matusp wrote: post #70
raywatcher wrote: post #5

For all the discussions about the slopification of the internet, the human toll on open source maintainers isn’t really talked about. It's one thing to get flooded with bad reports; it's another to have to mentally filter AI-generated submissions designed to "sound correct" but offer no real value. Totally agree with the author mentioning the emotional toll it takes to deal with these mind-numbing stupidities.

It's human toll everywhere. AI used for peer review effectively forces researchers to implement suggestions between revisions, AI used by managers suggest bad solutions that engineers are forced to implement, etc. Effectively, the number of person-hours that is spent following whatever AI models suggest is increasing rapidly. Some of it might make sense, but uncomfortably many hours are burned in vain. There is a rea…

[dead]

Re: Death by a Thousand Slops

#73

Post by jdefr89 »

Some of these AI slop report exchanges are absolutely hilarious. Love seeing people caught red handed then trying to play it off.. This is why Vulnerability Research needs more gatekeeping.

Re: Death by a Thousand Slops

#75

Post by teddy-smith »

ta8645 wrote: post #57
meindnoch wrote: post #39

Earlier quoted context omitted.

An olympic weightlifter doing clean and jerk with 150kg is worthy of my attention. A Komatsu forklift doing the same is not.

> A Komatsu forklift doing the same is not ... [worthy of attention] It is, if you're managing a warehouse; then it's a wonderful marvel. And it is a hidden benefit to everyone who receives cheaper products from that warehouse. Nobody cares if it's a human or the Komatsu doing the heavy lifting.

Well warehouse mangers excluded....

Re: Death by a Thousand Slops

#76

Post by Aachen »

jannes wrote: post #71
armchairhacker wrote: post #60

You could charge a fee and give the money back if the report is wrong but seems well-intentioned. I see the issue with this, it's payment platforms. Despite the hate, cryptocurrency seems like it could be a solution. But in practice, people won't take time to set up a crypto wallet just to submit a bug report, and if crypto becomes popular, it may get regulations and middlemen like fiat (which add friction, e.g. char…

This is probably something that the platform HackerOne should implement. It can't be addressed on the project level. https://hackerone.com/curl/hacktivity

Why?

I don't know if the link you posted answers the question, I get a blocked page ("You are visiting this page because we detected an unsupported browser"). You'd think a chromium-based browser would be supported but even that isn't good enough. I love open standards like html and http...

Edit: just noticed it goes to hackerone and not curl's own website. Of course they'd say curl can't solve payments on their own

Re: Death by a Thousand Slops

#79

Post by jdefr89 »

placardloop wrote: post #42

These AI reports are just an acceleration of the slop created by similar human “researchers”. The real root cause of this is that most security “professionals” have been trained to do the bare minimum of work and expect a payday from it. There’s an entire industry of “penetration testers” that do nothing more than run Fortify against your code base and then expect you to pay them $100k for handing over the findings r…

Professional Vulnerability Researcher here... You are correct. Over the years this industry has seen an influx of script kiddies who do nothing but run tools. It's sad but I really think this field needs more gate keeping...

Re: Death by a Thousand Slops

#80

Post by lysace »

appreciatorBus wrote: post #65
lysace wrote: post #12

Sort of separate but perhaps also relevant to the thousands cuts/slops: Isn't the scope of curl/libcurl a bit too big? It supports almost every file-related networking protocol under the sun and a few more just for fun. ( https://everything.curl.dev/protocols/curl.html ) Meanwhile 99.8% of users (assuming) just use it for HTTP. Here's a few complex protocols I bet many do not know that curl supports: - SMB - IMAP - L…

I’m sure the case could be made before a more focussed project, but I think this is orthogonal to bad (or stupid) actors using AI to overwhelm bug reporting channels. The issue highlighted in the article is people using AI to invent security problems that don’t exist. That doesn’t go away, no matter much you stripped down or simplify the project. I’d bet an AI writing tool will happily generate thousands of realistic…

I guess you are saying that we should build another tool, or fork curl and then remove non-http stuff. Then the world should transition from curl oneliners to, say, qurl oneliners.
Post reply on HN