Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

21–30 of 271 posts

Re: cURL removes bug bounties

#21

Post by f311a »

novalis78 wrote: post #7

Just use an LLM to weed them out. What’s so hard about that?

How would it work if LLMs provide incorrect reports in the first place? Have a look at the actual HackerOne reports and their comments.

The problem is the complete stupidity of people. They use LLMs to convince the author of the curl that he is not correct about saying that the report is hallucinated. Instead of generating ten LLM comments and doubling down on their incorrect report, they could use a bit of brain power to actually validate the report. It does not even require a lot of skills, you have to manually tests it.

Re: cURL removes bug bounties

#23

Post by saghm »

dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

That anecdote is hilarious and scary in equal measures. Optional passwords are certainly more convenient than required ones, but so are optional PINs. The most convenient UX would be never needing to log in at all! Unless you find it inconvenient for others to have access to your bank account of course

Re: cURL removes bug bounties

#26

Post by johncoltrane »

plastic041 wrote: post #19
eknkc wrote: post #2

A list of the slop if anyone is interested: https://gist.github.com/bagder/07f7581f6e3d78ef37dfbfc81fd1d...

In the second report, Daniel greeted the slopper very kindly and tried to start a conversation with them. But the slopper calls him by the completely wrong name. And this was December 2023. It must have been extremely tiring.

> slopper

First new word of 2026. Thank you.

Re: cURL removes bug bounties

#27

Post by sersi »

saghm wrote: post #23
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

That anecdote is hilarious and scary in equal measures. Optional passwords are certainly more convenient than required ones, but so are optional PINs. The most convenient UX would be never needing to log in at all! Unless you find it inconvenient for others to have access to your bank account of course

I really hate the current trend of not having passwords. For example perplexity doesn't have a password, just an email verification to login.

Re: cURL removes bug bounties

#29

Post by ValveFan6969 »

jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

"open source" and "business model" in the same sentence... next you're gonna tell me to eat pudding with a fork.
Post reply on HN