Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

161–170 of 303 posts

Re: We are retiring our bug bounty program

#161

Post by Neywiny »

Uvix wrote: post #91
Neywiny wrote: post #67

Earlier quoted context omitted.

As per the other person's comment, yeah basically I could have broken it up but it would've been an arbitrary demarcation. I just deleted our functions and fixed everything that yelled. Admittedly that could've been one and then leveraging the libraries better could've been another, but they would've been 2 PRs that changed almost every line. So done as one to mitigate review time.

Why not leave your functions but have them invoke the libraries instead?

They weren't drop in replacements. They were actually easier. Made up example:

> setup_terminal(); enable_input(); while(...) inp = read_character(); .....

vs

> readline()

So yes I could've stubbed out the other stuff and replaced just one, but that's just adding tech debt

Re: We are retiring our bug bounty program

#162

Post by IshKebab »

MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Phabricator used to run on a similar system. You had to pay to send them bug reports & feature requests.

Sounds a bit weird for an open source project but I can tell you that the one company I worked at that used Phabricator did pay (and they definitely wouldn't have otherwise) so I think it's a viable strategy. Plus it makes you immune to slop!

On the other hand they did shut down a year or so ago though. Didn't say why.

Re: We are retiring our bug bounty program

#163

Post by hunterpayne »

CharlesW wrote: post #78
limaoscarjuliet wrote: post #27

Earlier quoted context omitted.

"[...] bottleneck isn't in writing the code. It is in reading and understanding the code". 100% agreed! Furthermore, the more code is generated by AI, the fewer people will actually understand it!

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

That's a you problem. If you feel this way, its the universe saying that you aren't very good at writing software. Good engineers don't have this problem.

PS We have way too many levels of abstraction now, that doesn't mean the right answer is to add another. Even worse unlike the others, LLMs aren't deterministic.

Re: We are retiring our bug bounty program

#164

Post by thfuran »

CamperBob2 wrote: post #129
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

$100 is way too much. Maybe $5 to get people to spend 30 seconds on google to solve the easy problems instead of calling. But I wonder if even that would be enough to significantly incentivize claiming everything is intended behavior / user error just for another revenue stream.

Re: We are retiring our bug bounty program

#165

Post by stackskipton »

CamperBob2 wrote: post #129
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

My guess is there is no easy way to deal with chargebacks and they would probably be bad.

It would almost need to be analog. Fill out this form and drop it in the mail with 10 bucks inside.

Re: We are retiring our bug bounty program

#166

Post by ChrisMarshallNY »

6031769 wrote: post #120
ChrisMarshallNY wrote: post #69

Earlier quoted context omitted.

That's a great project! It's likely to get blacklisted by AI bots, soon enough, though.

There's an AI bot blacklist? How do I get all my projects onto that?

One can dream…

Re: We are retiring our bug bounty program

#167

Post by miyoji »

bcjdjsndon wrote: post #143
miyoji wrote: post #127

Earlier quoted context omitted.

> The critics didn't do themselves any favors. Part think the Terminator has something useful to say on the subject, part invent contrived scenarios like self-driving cars having to resolve trolley problems. Reality turned out to be much more boring. You do very well in battles against straw men.

I guarantee you AI will not end the world

I never said it did, "doom" in this case is just "any negative consequences of AI", because anyone saying that AI could lead to negative consequences has been accused of "doomerism". My point is simply that the negative consequences are here right now, in the room with us, and AI boosters are still pretending that they don't exist.

Re: We are retiring our bug bounty program

#168

Post by travisgriggs »

CamperBob2 wrote: post #129
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

It’s hard to forecast this. Support calls occur chaotically. So staffing to support them is difficult to do in a way that keeps a steady margin.

Re: We are retiring our bug bounty program

#169

Post by swatcoder »

CharlesW wrote: post #78
limaoscarjuliet wrote: post #27

Earlier quoted context omitted.

"[...] bottleneck isn't in writing the code. It is in reading and understanding the code". 100% agreed! Furthermore, the more code is generated by AI, the fewer people will actually understand it!

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

Consider a plumber who doesn't understand mettalurgy or electronics but relies on some foundational trade principles that they learned from a mentor and who can understand manufacturer guides for clever new fittings and pumps.

That's the level that most competent software engineers should be working at.

Delegating understanding to LLM's is totally different thing. It's not plumbing at all. It's more like hiring a unlicensed, generalist but well-reputed handyman from Craigslist and then going out to a movie while they do the work. It could turn out fine, or not, and if it does work out, it could even save time and money if they're rate is low enough.

But it's not plumbing anymore, and you should be wary about billing plumber's rates for their work or taking on liability for it if you haven't even made sure that work meets your own standards of trade and quality.

You can argue that it's "one more level of abstraction" but it's a qualitatively different kind of abstraction. And in the economy of skilled labor, and the legal landscape of accountability and liability, that difference is enormously relevant.

Re: We are retiring our bug bounty program

#170

Post by kccqzy »

singpolyma3 wrote: post #66

It's a bit odd that this comes today after so many other projects reverse this finding.

Reverse what?

Let’s take curl as an example. Daniel Stenberg wrote about how he had to stop curl’s bug bounty program due to prevalent AI slop[0]. He also wrote about how he eventually restarted security bug reports without a bounty[1]. It turns out that without a bounty, the reports are higher quality. It almost seems like by removing the monetary incentive, it attracts people who are reporting bugs due to genuine altruism and concern for security, rather than hope for a quick buck. It feels like it harkens back to an earlier age of free software development on the Internet untainted by commercial interests.

So my opinion is that security bug reports should continue, but bug bounties should not. Turso should probably still encourage corruption bug reports but with no bounty.

[0]: https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-b...

[1]: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

Post reply on HN