Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

131–140 of 303 posts

Re: We are retiring our bug bounty program

#131

Post by jmuguy »

embedding-shape wrote: post #61
jmuguy wrote: post #12

I wonder what Hacktoberfest would look like now if they were still giving out t-shirts to everyone. Probably not enough cotton in the world. It can't be on individual maintainers to stop this, imo its on Github (and Gitlab) to stop these sort of accounts from even getting to the point of submitting PRs. Its essentially spam. Look at the user who created the first PR they reference https://github.com/Samuelsills . Thi…

An account with zero activity doing nothing shouldn't be allowed to continue doing nothing? Did you share the wrong account here maybe?

Its the account that posted this PR https://github.com/tursodatabase/turso/pull/6257

Re: We are retiring our bug bounty program

#132

Post by reaperducer »

ryandrake wrote: post #118
Lalabadie wrote: post #45

Good time to mention this fantastic repo acting as a bot honeypot: https://github.com/UnsafeLabs/Bounty-Hunters The corresponding leaderboard: https://clankers-leaderboard.pages.dev

I don't understand this. If that project is not offering a bug bounty, why are they getting so many PRs? What possible incentive is there to spend real money on tokens just to push junk PRs? Are the PRs spamming a product or something?

Maybe once the account has enough stars and reputation, the human behind it will use it to try to get an actual paying job.

Almost every time someone on HN asks how to increase their chances of employment, the response is to contribute to other people's Git* projects.

Re: We are retiring our bug bounty program

#133

Post by empath75 »

arian_ wrote: post #130

we automated finding bugs. then we automated submitting bugs. now we're automating rejecting submissions. at no point did anyone automate fixing the bugs.

Fixing bugs has been automated by claude code and other tools for a while. We've merged a bunch of bug-fix PRs by claude, some of which were found by other bots.

Re: We are retiring our bug bounty program

#134

Post by spockz »

Uvix wrote: post #91
Neywiny wrote: post #67

Earlier quoted context omitted.

As per the other person's comment, yeah basically I could have broken it up but it would've been an arbitrary demarcation. I just deleted our functions and fixed everything that yelled. Admittedly that could've been one and then leveraging the libraries better could've been another, but they would've been 2 PRs that changed almost every line. So done as one to mitigate review time.

Why not leave your functions but have them invoke the libraries instead?

It depends a bit. But it would now mean that there are multiple ways of doing the same. Call your internal function or call the library directly. You need to put up some linting around it that people only use your function or the library function.

Otherwise you may get that you have your function, you think everywhere is using it, you make it fix a bug. And poof, you introduced bugs at the other call sites.

Re: We are retiring our bug bounty program

#135

Post by AlienRobot »

I'm sorry but I find the slop PR's hilarious.

>the author just injected garbage bytes manually into the database header, and then argued that this corrupted the database

>Steps to reproduce: Modified cli/main.rs to include a Vec with limited capacity. Forced a volatile write beyond the allocated bounds using std::ptr::write_volatile.

>author claims to have found a critical vulnerability that allows for the execution of arbitrary SQL statements. Imagine that? A SQL database that allows the execution of SQL statements. How can we ever recover from this.

I wonder why are they even doing this. Do any of these PRs ever win any money? It feels like they are burning down a forest thinking they'll find gold if they do it, without any evidence that there will be any gold after the forest is burnt down.

Re: We are retiring our bug bounty program

#136

Post by embedding-shape »

jmuguy wrote: post #131
embedding-shape wrote: post #61

Earlier quoted context omitted.

An account with zero activity doing nothing shouldn't be allowed to continue doing nothing? Did you share the wrong account here maybe?

Its the account that posted this PR https://github.com/tursodatabase/turso/pull/6257

I could have swear it said "0 contributions in the last year" when I opened the profile before, and it showed no activity in the contribution graph, but now I check again and it shows a bunch of stuff... Guess some request failed last time or something, my bad.

Re: We are retiring our bug bounty program

#137

Post by pphysch »

hnthrow0287345 wrote: post #101
chapinb wrote: post #17

Earlier quoted context omitted.

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

I have seen precisely zero consequences for these people because they usually leave after not too long and go somewhere else, sometimes for higher pay. The slower folks end up getting the worse code and no raises in exchange for comradery. But also I have no idea how that situation arises unless the slower folks are just auto-approving PRs. You kind of did that to yourself if you let the new person get away with it.

In objective terms, these tactical tornadoes are among the most valuable headcount at a big company to the extent that they can rapidly patch production issues and restore service, by any means possible.

The problem is allowing this kind of frantic tactical development even in "peace time".

Re: We are retiring our bug bounty program

#138

Post by empath75 »

miyoji wrote: post #75
dale_glass wrote: post #38

Earlier quoted context omitted.

> The solution is exactly what the linked article says: shut it down. At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

This response is incredibly annoying and insufferable. It's only "impossible" at this point because people continually ignored skeptics and anyone warning about exactly these outcomes. Now that doom is here, it's too late to do anything about it. Just accept the doom!

> Now that doom is here, it's too late to do anything about it. Just accept the doom!

What doom? This is a mildly annoying problem that will likely be self correcting long term.

Re: We are retiring our bug bounty program

#139

Post by bcjdjsndon »

caymanjim wrote: post #98
pscanf wrote: post #59

We sorely need a way to reliably detect AI slop, but unfortunately it doesn't seem possible and it's just getting harder and harder. Last month I tried my hand at finding a way to tell whether an OSS project is slop or not, based on the amount of "human attention" it received vs the amount of code it contains. The idea is that a 100k LOC project which received 3 days' worth of attention from a human is most certainly…

There's no reason to care that a human spent time on it. Humans are bad at writing code. Garbage PRs and slop have been a problem in open source and bug bounty programs since long before AI came on the scene. We need better AI so that there's no need to solicit external bug fixes, and better AI so other contributions can be evaluated for usefulness and quality. What do you care if a human ever looked at it at all? It…

Reasonable logic but I bet you get downvoted

Re: We are retiring our bug bounty program

#140

Post by smaudet »

hnthrow0287345 wrote: post #101
chapinb wrote: post #17

Earlier quoted context omitted.

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

I have seen precisely zero consequences for these people because they usually leave after not too long and go somewhere else, sometimes for higher pay. The slower folks end up getting the worse code and no raises in exchange for comradery. But also I have no idea how that situation arises unless the slower folks are just auto-approving PRs. You kind of did that to yourself if you let the new person get away with it.

> You kind of did that to yourself if you let the new person get away with it.

In theory, sure, but in practice, to echo the others, you often don't have a choice, because of power dynamics/politics.

Its easy to say "its management's fault", but the principle is the same - these guys are spammers and quacks (and deserve nothing less than to be confined to the level of hell reserved for spammers), they just have to spam long enough and something will get through (volume over quality). And after their "success" i.e. fraud, they can ditch the company and move onto the next. I've seen multiple "seniors" like this, not actually very good at the work, but great at pushing half-baked slop.

Post reply on HN