Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

81–90 of 271 posts

Re: cURL removes bug bounties

#81

Post by jeroenhd »

charcircuit wrote: post #75
anileated wrote: post #71

Earlier quoted context omitted.

When LLMs are based on stolen work and violate GPL terms, which should be already illegal, it's very much okay to be furious about the fact that they additionally ruin respective business models of open source, thanks to which they are possible in the guest place.

>“Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. https://www.gnu.org/philosophy/free-sw.html Being able to learn from the code is a core part of the ideology embedded into the GPL. Not only that, but LLMs learning from code is fair use.

That freedom for many free licenses comes with the caveat that you provide basic attribution and the same freedom to your users.

LLMs don't (cannot, by design) provide attribution, nor do LLM users have the freedom to run most of these models themselves.

Re: cURL removes bug bounties

#82

Post by [deleted] »

colechristensen wrote: post #64
GalaxyNova wrote: post #14

Earlier quoted context omitted.

Because LLMs are bad at reviewing code for the same reasons they are bad at making it? They get tricked by fancy clean syntax and take long descriptions / comments for granted without considering the greater context.

I don't know, I prompted Opus 4.5 "Tell me the reasons why this report is stupid" on one of the example slop reports and it returned a list of pretty good answers.[1] Give it a presumption of guilt and tell it to make a list, and an LLM can do a pretty good job of judging crap. You could very easily rig up a system to give this "why is it stupid" report and then grade the reports and only let humans see the ones that…

[deleted]

Re: cURL removes bug bounties

#83

Post by cynicalsecurity »

icar wrote: post #77
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

> I've since learned that anything heavily regulated like hospitals and banks will have security procedures catering to compliance, not actual security. I personally came to that conclusion thanks to the GrapheneOS situation regarding device attestation. Insecure devices get full features from some apps because they are certified, although they cite security, while GrapheneOS get half featured apps because it's "inse…

It's not about securing your device from external threats or bad actors; it's about securing the device from you.

Re: cURL removes bug bounties

#84

Post by catlifeonmars »

charcircuit wrote: post #75
anileated wrote: post #71

Earlier quoted context omitted.

When LLMs are based on stolen work and violate GPL terms, which should be already illegal, it's very much okay to be furious about the fact that they additionally ruin respective business models of open source, thanks to which they are possible in the guest place.

>“Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. https://www.gnu.org/philosophy/free-sw.html Being able to learn from the code is a core part of the ideology embedded into the GPL. Not only that, but LLMs learning from code is fair use.

> Being able to learn from the code is a core part of the ideology embedded into the GPL.

I have to imagine this ideology was developed with humans in mind.

> but LLMs learning from code is fair use

If by “fair use” you mean the legal term of art, that question is still very much up in the air. If by “fair use” you mean “I think it is fair” then sure, that’s an opinion you’re entitled to have.

Re: cURL removes bug bounties

#85

Post by dlcarrier »

sersi wrote: post #27
saghm wrote: post #23

Earlier quoted context omitted.

That anecdote is hilarious and scary in equal measures. Optional passwords are certainly more convenient than required ones, but so are optional PINs. The most convenient UX would be never needing to log in at all! Unless you find it inconvenient for others to have access to your bank account of course

I really hate the current trend of not having passwords. For example perplexity doesn't have a password, just an email verification to login.

That's what eBay does to me. You get to choose, at the time of login, between entering a password and getting an email verification, or just getting an email verification. At least with the bug report I had submitted to my bank, the password requirement had to be disabled from inside a settings menu, instead of being a clear option in the login prompt, but it that case it wasn't even a 2nd factor.

Re: cURL removes bug bounties

#86

Post by dlcarrier »

gamer191 wrote: post #15
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

Agreed, although the reimbursement should be based on whether a reasonable person could consider that to be a vulnerability. Often it’s tricky for outsiders to tell whether a behaviour is expected or a vulnerability

Yeah, the reimbursement would need to be for a good-faith submission worth considering, even if it wasn't actionable.

Re: cURL removes bug bounties

#87

Post by nusl »

bilekas wrote: post #32

I just read one of the slop submissions and it's baffling how anyone could submit these with a straight face. https://hackerone.com/reports/3293884 Not even understanding the expected behaviour and then throwing as much slop as possible to see what sticks is the problem with generative AI.

They don't care. They generate large amounts of these, spam them out, and hope for some small success. If they get banned or blocked, they make new accounts. Shame isn't even a factor; it's all about money. They don't even attempt to understand or care about a product.

This was partially the case before, where you'd still get weird spammy or extortive reports, but I guess LLMs enable random people to shoot their shot and gum up the works even more.

Re: cURL removes bug bounties

#88

Post by colechristensen »

exyi wrote: post #80
colechristensen wrote: post #64

Earlier quoted context omitted.

I don't know, I prompted Opus 4.5 "Tell me the reasons why this report is stupid" on one of the example slop reports and it returned a list of pretty good answers.[1] Give it a presumption of guilt and tell it to make a list, and an LLM can do a pretty good job of judging crap. You could very easily rig up a system to give this "why is it stupid" report and then grade the reports and only let humans see the ones that…

Ok, run the same prompt on a legitimate bug report. The LLM will pretty much always agree with you

find me one

Re: cURL removes bug bounties

#89

Post by charcircuit »

jeroenhd wrote: post #81
charcircuit wrote: post #75

Earlier quoted context omitted.

>“Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. https://www.gnu.org/philosophy/free-sw.html Being able to learn from the code is a core part of the ideology embedded into the GPL. Not only that, but LLMs learning from code is fair use.

That freedom for many free licenses comes with the caveat that you provide basic attribution and the same freedom to your users. LLMs don't (cannot, by design) provide attribution, nor do LLM users have the freedom to run most of these models themselves.

That is if you redistribute or make a derivative work. Applying learnings you made from such software does not require such attribution.

Re: cURL removes bug bounties

#90

Post by wrxd »

arjie wrote: post #66

It makes sense. This process of searching for bugs was slow and time-consuming so it needed to be incentivized. This is no longer the case. Now the hard part is in identifying which ones are real. To paraphrase a famous quote: AI-equipped bug hunters find 100 out of every 3 serious vulnerabilities.

> Now the hard part is in identifying which ones are real.

So it’s still a slow and time consuming process.

Post reply on HN