Live data from Hacker News

Curl: We still have not seen a valid security report done with AI help

linkedin.com

111–120 of 258 posts

Re: Curl: We still have not seen a valid security report done with AI help

#111
post #66

Earlier quoted context omitted.

Those people weren't engineers to start with.

Software engineers rarely are. I’m saying this tongue in cheek, but there’s some truth to it.

There is much truth. Railway engineers 'rarely were' too, once upon a time, and for in my view essentially the same reasons.

Re: Curl: We still have not seen a valid security report done with AI help

#112

Counterpoint we have a CVE attributable to ours and I suspect the difference is my co-founder was an offensive kernel researcher so our system is tuned for this in a way your average...ambulance chaser is unable to do. https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug https://www.cve.org/CVERecord?id=CVE-2025-31160 The amount of bad reports curl in particular has gotten is staggering and it's all from people wh…

I would try to find a better example than CVE-2025-31160. If you ask me, this kind of 'vulnerability' is CVE spam.

Re: Curl: We still have not seen a valid security report done with AI help

#113

Counterpoint we have a CVE attributable to ours and I suspect the difference is my co-founder was an offensive kernel researcher so our system is tuned for this in a way your average...ambulance chaser is unable to do. https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug https://www.cve.org/CVERecord?id=CVE-2025-31160 The amount of bad reports curl in particular has gotten is staggering and it's all from people wh…

I would try to find a better example than CVE-2025-31160. If you ask me, this kind of 'vulnerability' is CVE spam.

Except if you read the blog post we helped a very confused maintainer when they had this dropped on them with no explanation on hacker news except "oooh potential scary heap vuln"

Re: Curl: We still have not seen a valid security report done with AI help

#115
post #95

Earlier quoted context omitted.

That's why I said it's the 2025 version of that, given the new technology. I'm not saying it's the same thing. I guess I'm not being clear, sorry.

It’s not clear to me in what way it is a version of that, other than the response being different from what the asker wanted. The point of lmgtfy is to show that the asker could have legitimately and reasonably easily have found the answer by himself. You can argue that it is sometimes done on cases where googling actually wouldn’t provide the desired information, but that is far from the common case. This present ve…

Okay I see the confusion. We are coming from different perspectives.

There are three main reasons I can think of for asking the Internet a question in 2010:

1. You don't know how to ask Google / you are too lazy.

2. You don't trust Google.

3. You already tried Google and it doesn't have the answer or it's wrong.

Maybe there are more I can't think of. But let's say you have one of those three reasons, so you post a question to an Internet forum in the year 2010. Someone replies back with lmgtfy. There are three typical responses depending on which of the those reasons you had f or posting:

1. "Thanks"

2. "Thanks, but I don't trust those sources, so I reiterate my question."

3. "Thanks, but I tried that and the answer is wrong, so I reiterate my question."

Now it's the year 2025 and you post a question to an Internet forum because you either don't know how to ask ChatGPT, don't trust ChatGPT, or already tried it and it's giving nonsense. Someone replies back with an answer from ChatGPT. There are three typical responses depending on your reason for posting to the forum.

1. "Thanks"

2. "Thanks, but I don't trust those sources, so I reiterate my question."

3. "Thanks, but I tried that and the answer is wrong, so I reiterate my question."

So the reason I drew the parallel was because of the similarity of experiences between 2010 and now for someone who doesn't trust this new technology.

Re: Curl: We still have not seen a valid security report done with AI help

#116
post #79
post #55

Earlier quoted context omitted.

It can consult any sources about any topic, ChatGPT is as good at teaching as the pupil's capabilities to ask the right questions, if you ask me

It may well consult any source about the topic, or it may simply make something up. If you don't know anything about the subject area, how do you know if you are asking the right questions?

LLM fans never seem very comfortable answering the question "How do you know it's correct?"

Re: Curl: We still have not seen a valid security report done with AI help

#117
post #89

Shame they need to put up with that spam. However, every big open source project has by now had good contributions with "AI help". Many millions of developers are using AI a little as a tool, like Google.

And that increase in LLM usage has resulted in an enormous increase of code duplications and code churn in said open source projects. Any benefit from new features implemented by LLMs is being offset by the tech debt caused by duplication and the maintenance burden of constantly reverting bad code (i.e. churn).

https://arc.dev/talent-blog/impact-of-ai-on-code/

Re: Curl: We still have not seen a valid security report done with AI help

#118

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 is the latest example of a invalid curl report

Good god did they hallucinate the segmentation fault and the resulting GDB trace too? Given that the diffs don’t even apply and the functions don’t even exist, I guess the answer is yes - in which case, this is truly a new low for AI slop bug reports.

Re: Curl: We still have not seen a valid security report done with AI help

#119

I handle reports for a one million dollar bug bounty program. AI spam is bad. We've also never had a valid report from an by an LLM (that we could tell). People using them will take any being told why a bug report is not valid, questions, or asks for clarification and run them back through the same confused LLM. The second pass through generates even deeper nonsense. It's making even responding with anything but "clo…

This sounds more like an influx of scammers than security researchers leaning too hard on AI tools. The main problem is the bounty structure. And I don’t think these influx of low quality reports will go away, or even get any less aggressive as long as there is money to attract the scammers. Perhaps these bug bounty programs need to develop an automatic pass/fail tester of all submitted bug code, to ensure the reporter really found a bug, before the report is submitted to the vendor.

Re: Curl: We still have not seen a valid security report done with AI help

#120

Something that really frustrates me about interacting with (some) people who use AI a lot is that they will often tell me things that start “I asked ChatGPT and it said…” stop it!!! If the chatbot taught you something and you understood it, explain it to me. If you didn’t understand or didn’t trust it, then keep it to yourself!

I recently had this happen from a senior engineer. What's really frustrating is I TOLD them the issues and how to fix it. Instead of listening to what I told them, they plugged it into GPT and responded with "Oh, interesting this is what GPT says" (Which, spoiler, was similar but lacking from what I'd said). Meaning, instead of listening to a real-life expert in the company telling them how to handle the problem they…

I often do this - ask a LLM for an answer when I already have it from an expert. I do it to evaluate the ability of the LLM. Usually not in the presence of said expert tho.
Post reply on HN