We are retiring our bug bounty program

Post by therepanic » Fri, May 15, 2026, 3:17 PM UTC

malfist wrote: post #88

KolmogorovComp wrote: post #71

Earlier quoted context omitted.

Unfortunately this isn't all black-and-white. There are some bug bounty where the company is very eager not to pay any bounty, aggressively marking vulnerabilities as out-of-scope or working-as-intended. In those case you already lose time, but in the future you would also lose money. Unfortunately you don't know how a company will react before submitting, especially if it's a small one.

It already doesn't stand on face value. These people are spending money to open PRs via their token costs

Post by dogleash » Fri, May 15, 2026, 3:18 PM UTC

nixon_why69 wrote: post #28

wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

Context is everything for massive PRs. If you don't ever have a massive PR from a dynamite session, then you cannot ever be better than "average and plodding". So the question is, what's the context of the massive PR and how should it be handled? * Mature product making money, intermediate engineer just refactored everything so it's "better"? Shut the fuck up, kindly please, you will have to demonstrate that you unde…

Post by sowbug » Fri, May 15, 2026, 3:18 PM UTC

mort96 wrote: post #95

rvz wrote: post #80

Earlier quoted context omitted.

There are many cryptocurrencies that allow anyone to move money quickly, cheaply, and on the same day in less than a minute and requires zero bank accounts. At this point there isn't an excuse.

And which are trivial to convert back and forth between real money and cryptocurrency? And hold their value with sufficient stability that you can convert USD into the currency, make a transaction, wait a few weeks, make a transaction the other direction and then convert back into USD, with roughly no loss in value?

Post by Traubenfuchs » Fri, May 15, 2026, 3:19 PM UTC

sparklingmango wrote: post #51

satvikpendem wrote: post #32

Earlier quoted context omitted.

I don't understand why one wouldn't just auto reject big PRs and tell them to make smaller ones. Sounds like it's a communication and social problem, not a technological one. Even with AI, just tell it to make smaller self contained PRs. I do this with Claude or GPT models and they do just fine.

Power dynamics. Usually the person making the giant PRs is the one with all the sway. An earlier-career engineer is unlikely to push back against that level of influence.

Post by bigballsbjorn » Fri, May 15, 2026, 3:20 PM UTC

overgard wrote: post #72

The weird thing is it can't be that economically feasible to burn a ton of tokens in the hopes that you might get a bounty.. seems like a great way to set money on fire.