So AI slop is used to attempt to degrade the quality of cURL.
cURL removes bug bounties
141–150 of 271 posts
Re: cURL removes bug bounties
#142What I wonder is if this will actually reduce the amount of slop. Bounties are a motivation, but there's also promotional purposes. Show that you submitted thousands of security reports to major open source software and you're suddenly a security expert. Remember the little iot thing that got on here because of a security report complaining, among other things, that the linux on it did not use systemd?
I have a suspicion that most sloppers won't even get the memo about the discontinuation of the bounty program.
Re: cURL removes bug bounties
#143An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…
It may stop it but it may also hinder real people contributing. How many people want to pay a free in order to "contribute"?
Re: cURL removes bug bounties
#144It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code
AI is not submitting the slop, people are. This is not a technology, but ethics and respect problem. From the same article: > Not all AI-generated bug reports are nonsense. It’s not possible to determine the exact share, but Daniel Stenberg knows of more than a hundred good AI assisted reports that led to corrections. Meaning: developers and researchers who use the tool as it's meant to work, as a tool, are leveragin…
Technically true but that argument also won't let you bring your gun on a plane.
Re: cURL removes bug bounties
#145An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…
There's also the issue of what happens to my money as a researcher. Is it paid to the company, or is someone holding it in escrow? What if it takes the developer months to respond, or they never do? Do they just get to keep my money indefinitely? What if the vendor pulls out of the scheme? What if I do a chargeback on the payment I made? Etc, etc
I wonder if a better model would be to make the platform pay to entry, but not the specific bugs? So you have to pay a fee to gain access to a platform like HackerOne, and if your signal:noise ratio gets too bad then your account gets revoked? That would make it feel like less of a gamble than having to pay for every individual bug - but still has the same problem that it's putting a big barrier in front of legitimate good-faith researchers.
Re: cURL removes bug bounties
#146An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…
Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk. Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was bef…
Vulnerability disclosure is general is just miserable. Before all the bug bounty issues it was pretty common to:
* Spend ages trying to find someone to submit a report to.
* Waste a whole load of time fighting through the generic contact and support desks to try and get your report to someone who understood it.
* Get completely ignored by the developers.
* Spend time reporting a bug only for them to silently fix it without even bothering to respond to you, let alone acknowledge you.
* Get legal threats for making a good-faith bug report, even if you found it in an locally deployed instance of the software.
* Get called a black hat and more legal threats when you give up and just go down the full disclosure route.
Re: cURL removes bug bounties
#147Earlier quoted context omitted.
AI is not submitting the slop, people are. This is not a technology, but ethics and respect problem. From the same article: > Not all AI-generated bug reports are nonsense. It’s not possible to determine the exact share, but Daniel Stenberg knows of more than a hundred good AI assisted reports that led to corrections. Meaning: developers and researchers who use the tool as it's meant to work, as a tool, are leveragin…
Technically true but that argument also won't let you bring your gun on a plane.
The purpose of a tool is important.
Guns have no other purpose than doing harm.
E.g. We don't blame cars, the tool, for driving into a gathering of people that can kill a dozen of them, we blame the driver. The purpose is transport, the same way LLMs for coding are a tool for assisting coding tasks.
Re: cURL removes bug bounties
#148Earlier quoted context omitted.
And if you ask why it's accurate it'll spaff out another list of pretty convincing answers.
It does indeed, but at the end added: >However, I should note: without access to the actual crash file, the specific curl version, or ability to reproduce the issue, I cannot verify this is a valid vulnerability versus expected behavior (some tools intentionally skip cleanup on exit for performance). The 2-byte leak is also very small, which could indicate this is a minor edge case or even intended behavior in certai…
Yet this is not reproducible. This is the whole issue with LLMs: they are random.
You cannot trust that it'll do a good job on all reports so you'll have to manually review the LLMs reports anyways or hope that real issues didn't get false-negatives or fake ones got false-positives.
This is what I've seen most LLM proponents do: they gloss over the issues and tell everyone it's all fine. Who cares about the details? They don't review the gigantic pile of slop code/answers/results they generate. They skim and say YOLO. Worked for my narrow set of anecdotal tests, so it must work for everything!
IIRC DOGE did something like this to analyze government jobs that were needed or not and then fired people based on that. Guess how good the result was?
This is a very similar scenario: make some judgement call based on a small set of data. It absolutely sucks at it. And I'm not even going to get into the issue of liability which is another can of worms.
Re: cURL removes bug bounties
#149It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code
It has also really accelerated the army of hustlers who can't actually code but want to get a contributor badge on major repos to put on their resume.
It's not like this sort of hustling didn't exist prior to LLMs but the volume has ballooned massively.
Re: cURL removes bug bounties
#150An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…
> An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick.
That adds an extra layer of complexity to the cURL maintainers, handling other people’s money and whatnot. It was considered.
Daniel (cURL’s lead) has been discussing this for months. Whatever “quick and easy” solution you think of, it’s already been suggested and thought about and rejected for some reason.