Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

191–200 of 303 posts

Re: We are retiring our bug bounty program

#191

Post by replwoacause »

ToucanLoucan wrote: post #7

Oh look it's more of exactly what AI skeptics said would happen: low effort bullshit generated at scale making life hell for people actually trying to make things. That's wild. Edit: it is genuinely wild, I don't know of another product category that selects so perfectly for the WORST type of person to be it's enthusiast. Just every single person I see hyped about AI is fucking insufferable on at least one and usuall…

Crypto gives AI it a pretty good run for its money in this regard, though the Venn diagram here is probably close to a perfect circle.

Re: We are retiring our bug bounty program

#192

Post by thfuran »

stackskipton wrote: post #165
CamperBob2 wrote: post #129

Earlier quoted context omitted.

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

My guess is there is no easy way to deal with chargebacks and they would probably be bad. It would almost need to be analog. Fill out this form and drop it in the mail with 10 bucks inside.

Placing holds on money on a credit card is totally normal. Hotels do that all the time.

Re: We are retiring our bug bounty program

#193

Post by gobdovan »

I think a lot of this is exposing a change in assumed context, but it seems better to adapt to the new trends than discontinue security programs.

AI lets good-faith bug hunters look through more repos they are not deeply familiar with. They may recognize a bad pattern quickly, almost like a very specialized static-analysis rule. But without project context, it is not always clear whether something is a real bug, a footgun, expected behavior, or just out of scope.

The blog shows obvious slop examples, but I think borderline accepted vs rejected examples would be more useful. They would help people understand what is worth reporting and what would just drain maintainers.

It could also help to ask reporters to clarify how the bug was found so you let people set reasonable expectations: "AI-found and manually confirmed", "AI-assisted", or "no AI used".

Re: We are retiring our bug bounty program

#194

Post by pdimitar »

satvikpendem wrote: post #189
pdimitar wrote: post #84

Earlier quoted context omitted.

This "you should leave" thing is a very boring and tired take and it should be said regularly that almost no engineer can afford it nowadays. Beautiful theory, but only that.

What's the alternative? You push back or you don't, leaving you likelier to leave in the future. For non-junior devs, the market is still humming along.

I don't see how the market is humming along for anyone.

Then again, I have zero network. Maybe you can just call someone on the phone and jump ship next week? I can't. Many other people cannot as well.

My idea right now is to find ways to do things mostly my way and introduce a near-perfect meritocracy in my team. No seniors or juniors; I am technically "the most senior" but we all have differing and unique experiences. I share my experiences and when I feel stronger about something I make it clear why but I don't go sad in the corner if the other engineers overrule me.

Regardless of how the market is, I like getting along with people. Of course sometimes (actually: often) it's not possible in which case either a team restructuring should be done, or one should indeed leave (which is the nuclear option; not just "oh well, things did not work out").

Re: We are retiring our bug bounty program

#195

Post by datsci_est_2015 »

CharlesW wrote: post #78
limaoscarjuliet wrote: post #27

Earlier quoted context omitted.

"[...] bottleneck isn't in writing the code. It is in reading and understanding the code". 100% agreed! Furthermore, the more code is generated by AI, the fewer people will actually understand it!

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

There’s a large difference between understanding precisely what some code does and understanding what code intends to do. It’s why “what happens when you begin typing into your web browsers address bar?” is such a powerful question for weeding out low quality interview candidates. I’ve never worked at Google, but I can talk about how they probably handle the incoming requests. I’ve never worked on Windows OS-level software, but I can start talking about input buffers. Kind of reminds me of WIRED’s “5 Levels” series…

Anyway, my point is prompts are non deterministic and there’s no way of inferring what code output by an LLM is intended to do because that’s not how LLMs work

Re: We are retiring our bug bounty program

#196

Post by replwoacause »

micromacrofoot wrote: post #65
ToucanLoucan wrote: post #7

Oh look it's more of exactly what AI skeptics said would happen: low effort bullshit generated at scale making life hell for people actually trying to make things. That's wild. Edit: it is genuinely wild, I don't know of another product category that selects so perfectly for the WORST type of person to be it's enthusiast. Just every single person I see hyped about AI is fucking insufferable on at least one and usuall…

for every person that's hyping AI there are another 10 just using it to get stuff done without talking about it incessantly

I'm using it to do harder work and more of it for my employer for the same pay.

Re: We are retiring our bug bounty program

#197

Post by unnouinceput »

Aurornis wrote: post #122
MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

> Make submitters pay Asking people to pay to submit bugs would start a firestorm of internet drama about asking people to do free work for the company and pay for the privilege. It doesn’t matter if the program actually paid out. If they got even one report closed incorrectly we would never hear the end of it.

I see that as an absolute win. Free publicity and all that jazz. Plus idiots with their fake submissions of bugs will either bleed money or gtfo from my repo.

Re: We are retiring our bug bounty program

#198

Post by cyclopeanutopia »

gobdovan wrote: post #193

I think a lot of this is exposing a change in assumed context, but it seems better to adapt to the new trends than discontinue security programs. AI lets good-faith bug hunters look through more repos they are not deeply familiar with. They may recognize a bad pattern quickly, almost like a very specialized static-analysis rule. But without project context, it is not always clear whether something is a real bug, a fo…

> It could also help to ask reporters to clarify how the bug was found so you let people set reasonable expectations: "AI-found and manually confirmed", "AI-assisted", or "no AI used".

And why would they tell the truth?

Re: We are retiring our bug bounty program

#199

Post by Neywiny »

nightpool wrote: post #128
Neywiny wrote: post #67

Earlier quoted context omitted.

As per the other person's comment, yeah basically I could have broken it up but it would've been an arbitrary demarcation. I just deleted our functions and fixed everything that yelled. Admittedly that could've been one and then leveraging the libraries better could've been another, but they would've been 2 PRs that changed almost every line. So done as one to mitigate review time.

Arbitrary demarcations can still be valuable! Just because something is arbitrary doesn't mean that it's not helpful. Working in chunks will let you take more time to review each callsite individually, and increase your confidence in the changes In the future, I would definitely encourage you to explore a more iterative solution—fix the first 50 occurrences first, or maybe all the occurrences of a handful of function…

Well another problem is that there was a developer also working on those functions at the same time. So just like the recent post on a 25 million LoC reformat done in a weekend, it seemed better to do it in one fell swoop. If it's good enough at 25 million, I'm sure it's good enough at a few thousand

Re: We are retiring our bug bounty program

#200

Post by mrgoldenbrown »

hnthrow0287345 wrote: post #101
chapinb wrote: post #17

Earlier quoted context omitted.

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

I have seen precisely zero consequences for these people because they usually leave after not too long and go somewhere else, sometimes for higher pay. The slower folks end up getting the worse code and no raises in exchange for comradery. But also I have no idea how that situation arises unless the slower folks are just auto-approving PRs. You kind of did that to yourself if you let the new person get away with it.

> I have no idea how that situation arises unless the slower folks are just auto-approving PRs.

Restricting changes to PR's is nowhere near universal.

Post reply on HN