Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

201–210 of 271 posts

Re: cURL removes bug bounties

#201

Post by catlifeonmars »

charcircuit wrote: post #97
catlifeonmars wrote: post #84

Earlier quoted context omitted.

> Being able to learn from the code is a core part of the ideology embedded into the GPL. I have to imagine this ideology was developed with humans in mind. > but LLMs learning from code is fair use If by “fair use” you mean the legal term of art, that question is still very much up in the air. If by “fair use” you mean “I think it is fair” then sure, that’s an opinion you’re entitled to have.

>question is still very much up in the air It is not up in the air at all. It's completely transformative.

Last time I checked, there are still undecided cases wrt fair use. Sure, it’s looking favorable for LLM training, but it’s definitely still up in the air.

> it’s completely transformative

IANAL, but apparently hinges on how the training material is acquired

Re: cURL removes bug bounties

#202

Post by notepad0x90 »

usrbinbash wrote: post #170
notepad0x90 wrote: post #168

This is silly, people don't need AI to send you garbage. If your project is getting lots of junk reports, you should take it as a good sign, that people are looking at it a lot now. You don't remove the incentive, you ask for help to triage the junk. Curl is a popular and well supported tool, if it needs help in this area, there will be a long line of competent people not volunteering their time and/or money. If you…

> This is silly, people don't need AI to send you garbage People also don't need cigarettes to fall ill. But smoking still causes health problems.

What's your point? Because people smoke cigarettes, people who buy unrelated things should be punished? Or because a store sells cigarettes, stores in general shouldn't be paid for what they sell? Or is the time and effort to find vulns valueless?

Re: cURL removes bug bounties

#203

Post by nospice »

zrm wrote: post #47
nospice wrote: post #18

Earlier quoted context omitted.

> An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. The problem is that bug bounty slop works . A lot of companies with second-tier bug bounties outsource triage to contractors (there's an entire industry built around that). If a report looks plausible, the contractor files a bug. The engineers who receive the report are often not qualified to debate exploitability, so they j…

Triage gets outsourced because the quality of reports is low. If filing a bad report costs money, low quality reports go down. Meanwhile anyone still doing it is funding your top notch security team because then they can thoroughly investigate the report and if it turns out to be nothing then the reporter ends up paying them for their time.

My point is that on average, filing bad but plausibly-sounding reports makes the reporter money. Curl is the odd exception with naming-and-shaming, not the rule. Spamming H1 with AI-generated reports is lucrative. A modest deposit is unlikely to change that. A big deposit (thousands of dollars) would, but it would also discourage a lot of legitimate reports.

Re: cURL removes bug bounties

#204

Post by catlifeonmars »

TeMPOraL wrote: post #156
catlifeonmars wrote: post #84

Earlier quoted context omitted.

> Being able to learn from the code is a core part of the ideology embedded into the GPL. I have to imagine this ideology was developed with humans in mind. > but LLMs learning from code is fair use If by “fair use” you mean the legal term of art, that question is still very much up in the air. If by “fair use” you mean “I think it is fair” then sure, that’s an opinion you’re entitled to have.

> I have to imagine this ideology was developed with humans in mind. Actually, you don't have to. You just want to. N=1 but to me, LLMs are a perfect example of where the "ideology embedded into the GPL" benefits the world. The point of Free Software isn't for developers to sort-of-but-not-quite give away the code. The point of Free Software is to promote self-sufficient communities . GPL through its clauses, particu…

> Actually, you don't have to. You just want to.

Fair.

> The point of Free Software isn't for developers to sort-of-but-not-quite give away the code. The point of Free Software is to promote self-sufficient communities.

… that are all reliant on gatekeepers, who also decide the model ethics unilaterally, among other things.

> (INB4: The fact that good LLMs are themselves owned by some multinational corps is irrelevant - much in the same way as cars are important tool for personal and communal self-sufficiently, despite being designed and manufactured by few large corporations. They're still tools ~anyone can use.)

You’re not wrong. But wouldn’t the spirit of Free Software also apply to model weights? Or do the large corps get a pass?

FWIW I don’t have a problem with LLMs per se. Just models that are either proprietary or effectively proprietary. Oligarchy ain’t freedom :)

Re: cURL removes bug bounties

#205

Post by cestith »

zvqcMMV6Zcr wrote: post #113
arionmiles wrote: post #38

Earlier quoted context omitted.

I find this to be a very amusing critique. In my experience, Notion (when I stopped using it 3 years ago) was slow as molasses. Slow to load, slow to update. In comparison, at work, I almost exclusively favor Confluence Cloud. It's very responsive for me. We have tons of Confluence wikis, updated frequently.

I think it might be the same issue as with WordPress and Jira - terrible plugins. Each company uses own special mix, and encounters issues often occurring in that one specific configuration. And it is the base platform that takes the blame.

In particular a place I used to work had a plugin for threaded comments in Jira. The specific one we were using slowed things down noticeably with the DB on the same server, but not too much to be an improvement in overall usefulness.

Then we decided trying to make our Jira more reliable by splitting the DB out into a separate clustered DB system in the same data center. The latency difference going through a couple of switches and to another system really added up with those extra 1600 or so DB calls per page load.

We ended up doing an emergency reversion to an on-host DB. Later, we figured out what was causing that many queries.

Re: cURL removes bug bounties

#206

Post by 72deluxe »

delfinom wrote: post #159
pravj wrote: post #100

Earlier quoted context omitted.

Extending on the same line, we will see programs like Google Summer of Code (GSoC) getting a massive revamp, or they will stop operating. From my failed attempt, I remember that - Students had to find a project matching their interests/skills and start contributing early. - We used to talk about staying away from some projects with a low supply of students applying (or lurking in the GitHub/BitBucket issues) because…

GSoC 4 years ago removed the need for their to be actual students to apply. We got flooded with middle aged men working 9-5s applying. It was dumb and we stopped participating. Their incentives were literally "extra income" instead of learning or participating beyond that.

But that sounds rewarding for the applicants, and the project?? The project gets code, and the guys get some money.

Being a middle aged man working 9 to 5, I would enjoy contributing to a project I was interested in rather than the boring job at work.

Are you saying you only wanted penniless youngsters to contribute, based entirely on their idealism?

Re: cURL removes bug bounties

#207

Post by anileated »

charcircuit wrote: post #97
catlifeonmars wrote: post #84

Earlier quoted context omitted.

> Being able to learn from the code is a core part of the ideology embedded into the GPL. I have to imagine this ideology was developed with humans in mind. > but LLMs learning from code is fair use If by “fair use” you mean the legal term of art, that question is still very much up in the air. If by “fair use” you mean “I think it is fair” then sure, that’s an opinion you’re entitled to have.

>question is still very much up in the air It is not up in the air at all. It's completely transformative.

1. It's decided by courts in US. Courts in US currently are very friendly to big tech. At this point if they deny this and say something that undermines this industry it's going to be a big economic blow, the country is way over-invested in this tech and its infrastructure.

2. "Transformative means fair" is the old idea from pre-LLM world. That's a different world. Now those IP laws are obsolete and need to be significantly updated.

Re: cURL removes bug bounties

#208

Post by 72deluxe »

ILoveHorses wrote: post #111

A video showing some of the gems which most likely led to this frustration: https://youtu.be/8w6r4MKSe4I?si=7nfRd0VmX8tvXAnY

I started watching it but the modern presentation style of shouting everything instead of speaking at a normal volume, and using many many gestures and facial expressions to state a simple sentence made me switch it off rapidly.

It seems to be a presentation style afflicting the YouTube generation, where they think you want to see a colossal microphone in someone's face (directional microphones work very well, and is a reason you can hear dialogue in a film without a mic in front of everyone) whilst they gesticulate wildly and over-emphasise words in a sentence. It is quite wearying; perhaps it's because I am British, but it is afflicting general conversation where only superlatives can be used ("awesome" "amazing" "insane" "mind-blowing") instead of "good"/"enjoyable".

Re: cURL removes bug bounties

#210

Post by anileated »

catlifeonmars wrote: post #204
TeMPOraL wrote: post #156

Earlier quoted context omitted.

> I have to imagine this ideology was developed with humans in mind. Actually, you don't have to. You just want to. N=1 but to me, LLMs are a perfect example of where the "ideology embedded into the GPL" benefits the world. The point of Free Software isn't for developers to sort-of-but-not-quite give away the code. The point of Free Software is to promote self-sufficient communities . GPL through its clauses, particu…

> Actually, you don't have to. You just want to. Fair. > The point of Free Software isn't for developers to sort-of-but-not-quite give away the code. The point of Free Software is to promote self-sufficient communities. … that are all reliant on gatekeepers, who also decide the model ethics unilaterally, among other things. > (INB4: The fact that good LLMs are themselves owned by some multinational corps is irrelevan…

> > Actually, you don't have to. You just want to.

> Fair.

I don't think it's fair. That ideology was unquestionably developed with humans in mind. It happened in the 80s, and back then I don't think anyone had a crazy idea that software can think for itself and so terms "use" and "learn" can apply to it. (I mean, it's a crazy idea still, but unfortunately not to everyone.)

One can suggest that free software ideology should be expanded to include software itself in the beneficiaries of the license, not just human society. That's a big call and needs a lot of proof that software can decide things on its own, and not just do what humans tell it.

Post reply on HN