Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

101–110 of 271 posts

Re: cURL removes bug bounties

#101

Post by golem14 »

mirekrusin wrote: post #44
golem14 wrote: post #11

Earlier quoted context omitted.

I looked at two reports, and I can’t tell if the reports are directly from an ai or some very junior student not really understanding security. LLms to me sound generally more convincing.

Some (most?) are llm chat copy paste addressing non existing users in conversations like [0] - what a waste of time. [0] https://hackerone.com/reports/2298307

Yeah, that one is pretty clearly written with the help of AI. This could well be the work of a larger group, say a state actor, trying to overwhelm reviewers and crowd out real reports. And if not yet, then for sure going forward ...

Re: cURL removes bug bounties

#102

Post by StrauXX »

The solution for this, IMO, is flags. Just like with CTFs, host an instance of your software with a flag that can only be retrieved after a successful exploit. If someone submits the flag to you, there is no argueing about wether or not they found a valid vulnerability.

Yes, this does not work for all vulnerability classes, but it is the best compromise in my mind.

Re: cURL removes bug bounties

#103

Post by StrauXX »

arjie wrote: post #66

It makes sense. This process of searching for bugs was slow and time-consuming so it needed to be incentivized. This is no longer the case. Now the hard part is in identifying which ones are real. To paraphrase a famous quote: AI-equipped bug hunters find 100 out of every 3 serious vulnerabilities.

The process of finding bugs is still slow and time consuming. The kinds of vulnerabilities you find in codebases like cURL are still beyond AI. Binary exploitation is still a human only field.

Re: cURL removes bug bounties

#104

Post by duxup »

dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

Are bug reports a 100% sure black and white thing?

Could people who think they found a bug but not sure be turned off by the up front cost / risk of finding out they are wrong or not technically finding a bug?

Re: cURL removes bug bounties

#106

Post by GardenLetter27 »

jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

How so? I think the Bazaar model has the most to gain - contributors can use LLMs to create PRs, and you can choose from a vast array of projects depending on how much you trust vibe coding.

Re: cURL removes bug bounties

#107

Post by snowmobile »

StrauXX wrote: post #102

The solution for this, IMO, is flags. Just like with CTFs, host an instance of your software with a flag that can only be retrieved after a successful exploit. If someone submits the flag to you, there is no argueing about wether or not they found a valid vulnerability. Yes, this does not work for all vulnerability classes, but it is the best compromise in my mind.

How exactly would that work? Curl isn't exactly software that can be "hosted" somewhere, and I'm not sure where you'd hide the flag in the software? Either very few actual vulns would end up being able to retrieve the flag, or it would be trivial to retrieve the flag without an exploit.

Re: cURL removes bug bounties

#108

Post by TeMPOraL »

fredrikholm wrote: post #16
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

> An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. I refer to this as the Notion-to-Confluence cost border. When Notion first came out, it was snappy and easy to use. Creating a page being essentially free of effort, you very quickly had thousands of them, mostly useless. Confluence, at least in west EU, is offensively slow. The thought of adding a page is sufficiently demor…

The term I know / used for this is "trivial inconveniences", via an old article of Scott Alexander[0].

The quote from example from early in the article stuck with me for years:

Think about this for a second. The human longing for freedom of information is a terrible and wonderful thing. It delineates a pivotal difference between mental emancipation and slavery. It has launched protests, rebellions, and revolutions. Thousands have devoted their lives to it, thousands of others have even died for it. And it can be stopped dead in its tracks by requiring people to search for "how to set up proxy" before viewing their anti-government website.

(Now this is more poetic, but I suppose the much more insightful example that also stuck with me is given later - companies enticing you to buy by offering free money, knowing well that most customers can't be arsed to fill out a form to actually get that money.)

--

[0] - https://www.lesswrong.com/posts/reitXJgJXFzKpdKyd/beware-tri...

Re: cURL removes bug bounties

#109

Post by trashb »

cynicalsecurity wrote: post #83
icar wrote: post #77

Earlier quoted context omitted.

> I've since learned that anything heavily regulated like hospitals and banks will have security procedures catering to compliance, not actual security. I personally came to that conclusion thanks to the GrapheneOS situation regarding device attestation. Insecure devices get full features from some apps because they are certified, although they cite security, while GrapheneOS get half featured apps because it's "inse…

It's not about securing your device from external threats or bad actors; it's about securing the device from you.

I see it a little differently. I would change your statement to the following:

It's not about securing your device from external threats or bad actors; it's about securing the organization from any blame / wrongdoing.

Most organizations today are looking high and low to shove the blame to others instead of taking responsibility.

Re: cURL removes bug bounties

#110

Post by entuno »

dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

A problem with this approach is that one of the key functions of a bug bounty program is to encourage people to report vulnerabilities to the developers, rather than selling them elsewhere.

If I have to pay money to submit a vulnerability to the developers with no guarantee that I'll even get refunded for a high quality and good faith report, let alone any actual payout, there's much less incentive for me to do so compared to selling them to someone else who won't charge me money for the privilege.

Post reply on HN