Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

141–150 of 303 posts

Re: We are retiring our bug bounty program

#141

Post by jubilanti »

ryandrake wrote: post #118
Lalabadie wrote: post #45

Good time to mention this fantastic repo acting as a bot honeypot: https://github.com/UnsafeLabs/Bounty-Hunters The corresponding leaderboard: https://clankers-leaderboard.pages.dev

I don't understand this. If that project is not offering a bug bounty, why are they getting so many PRs? What possible incentive is there to spend real money on tokens just to push junk PRs? Are the PRs spamming a product or something?

Why does every programming job application ask for your GitHub profile? The industry used open source contributions as a proxy for candidate quality, and this is Goodhart's law in action.

Re: We are retiring our bug bounty program

#142

Post by sowbug »

adamtaylor_13 wrote: post #93

Being a verifiable human identity (not as-in age verification or whatever) but as in having a known, public, reputation online will go a long way in this new slop-first world.

There is hardly a bright line between real and fake. An influencer is just a person who rents out their identity. Can you imagine getting a real PR from a human engineer you trust, but the description says "This pull request was sponsored by Skeezy Software Inc."?

Re: We are retiring our bug bounty program

#143

Post by bcjdjsndon »

miyoji wrote: post #127
dale_glass wrote: post #100

Earlier quoted context omitted.

The critics didn't do themselves any favors. Part think the Terminator has something useful to say on the subject, part invent contrived scenarios like self-driving cars having to resolve trolley problems. Reality turned out to be much more boring. But yes, what you said but unironically. Like it or not it's here, it's not going away, so all the remaining options have to assume that.

> The critics didn't do themselves any favors. Part think the Terminator has something useful to say on the subject, part invent contrived scenarios like self-driving cars having to resolve trolley problems. Reality turned out to be much more boring. You do very well in battles against straw men.

I guarantee you AI will not end the world

Re: We are retiring our bug bounty program

#144

Post by bcjdjsndon »

jcgrillo wrote: post #55
dale_glass wrote: post #38

Earlier quoted context omitted.

> The solution is exactly what the linked article says: shut it down. At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

> forget about the shutting it down and think of something actually realistic. Why is it not realistic? Small teams do excellent work. Keep your team small and trusted. Only accept contributions from your team, and people outside your team who are personally vouched for by someone on your team. It's like climbing mountains or sailing or any other type of inherently risky activity--you don't go out with people you don…

> It's eminently possible, you just don't like the idea of it.

Sounds like you can't accept AI is here to stay

Re: We are retiring our bug bounty program

#145

Post by AlienRobot »

arian_ wrote: post #130

we automated finding bugs. then we automated submitting bugs. now we're automating rejecting submissions. at no point did anyone automate fixing the bugs.

Be careful for what you wish.

Someone automated rewriting Bun in Rust, allegedly fixing the bugs.

Re: We are retiring our bug bounty program

#146

Post by shimman »

xandrius wrote: post #26
ToucanLoucan wrote: post #7

Oh look it's more of exactly what AI skeptics said would happen: low effort bullshit generated at scale making life hell for people actually trying to make things. That's wild. Edit: it is genuinely wild, I don't know of another product category that selects so perfectly for the WORST type of person to be it's enthusiast. Just every single person I see hyped about AI is fucking insufferable on at least one and usuall…

To be fair, you're not making a compelling case for your team either.

Sure if you close your eyes and ignore the evidence all around you...

Re: We are retiring our bug bounty program

#147

Post by jrgd »

it seems we all will slowly learn to live within new contexts; i really appreciate their openness about it and it gives me insights to munch on thanks to you all also to ring in with dev-style annecdotes (i'm stilllearning everyday, and hope to continue for a long time): those big-prs and tactical tornadoes stories are helping keep the crafts and thinking afloat, somehow.

Re: We are retiring our bug bounty program

#148

Post by ToucanLoucan »

miyoji wrote: post #75
dale_glass wrote: post #38

Earlier quoted context omitted.

> The solution is exactly what the linked article says: shut it down. At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

This response is incredibly annoying and insufferable. It's only "impossible" at this point because people continually ignored skeptics and anyone warning about exactly these outcomes. Now that doom is here, it's too late to do anything about it. Just accept the doom!

My only objection is calling it doom. It isn't and calling it that gives this stupid shit used by low-effort people far, far too much credit. It's just slop.

But it does suck, you know? Part of what makes OSS so great is that anyone could contribute. If someone uses a thing, and finds something broken or a way to make it better, they could do that and then push it back up to the project and ideally have it merged so everyone can use it. That's what makes it awesome. The project benefits, the maintainer benefits, the coder benefits, the users benefit.

Now we have to stop that because lazy people can't stop shitting it up with generated PRs and trying to get money for not fucking doing anything.

Re: We are retiring our bug bounty program

#149

Post by shimman »

bcjdjsndon wrote: post #143
miyoji wrote: post #127

Earlier quoted context omitted.

> The critics didn't do themselves any favors. Part think the Terminator has something useful to say on the subject, part invent contrived scenarios like self-driving cars having to resolve trolley problems. Reality turned out to be much more boring. You do very well in battles against straw men.

I guarantee you AI will not end the world

No one serious is arguing it will destroy the world (outside of LLM companies using these people as free marketing), the real critics argue that this is going to weaken labor while all the benefits go to the few capitalists and nothing ultimately improves in regards to society.

Unless improvement for you means increase cancer rates, exacerbating the climate crisis, or using poor systems to kill school children in wars.

All outcomes humans with souls typically want to avoid.

Re: We are retiring our bug bounty program

#150

Post by Kwpolska »

KolmogorovComp wrote: post #71
MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Unfortunately this isn't all black-and-white. There are some bug bounty where the company is very eager not to pay any bounty, aggressively marking vulnerabilities as out-of-scope or working-as-intended. In those case you already lose time, but in the future you would also lose money. Unfortunately you don't know how a company will react before submitting, especially if it's a small one.

I think it would be fair to distinguish "reasonable report, but not actually a vulnerability" (where you get the submission fee back) and "slop" (where you don’t).
Post reply on HN