Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

201–210 of 303 posts

Re: We are retiring our bug bounty program

#201

Post by [deleted] »

joe_mamba wrote: post #90
abirch wrote: post #25

Earlier quoted context omitted.

AI can be the ultimate tactical tornado.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

[deleted]

Re: We are retiring our bug bounty program

#202

Post by dotancohen »

joe_mamba wrote: post #90
abirch wrote: post #25

Earlier quoted context omitted.

AI can be the ultimate tactical tornado.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

  > monetary friction is THE ONLY (anonymous) WAY to filter out serious people from bad actors
How are monetary transactions anonymous?

Re: We are retiring our bug bounty program

#203

Post by CamperBob2 »

stackskipton wrote: post #165
CamperBob2 wrote: post #129

Earlier quoted context omitted.

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

My guess is there is no easy way to deal with chargebacks and they would probably be bad. It would almost need to be analog. Fill out this form and drop it in the mail with 10 bucks inside.

My guess is there is no easy way to deal with chargebacks and they would probably be bad.

Sure there is. That would be casus belli for a real ban.

Re: We are retiring our bug bounty program

#204

Post by abnercoimbre »

adamtaylor_13 wrote: post #190
sowbug wrote: post #142

Earlier quoted context omitted.

There is hardly a bright line between real and fake. An influencer is just a person who rents out their identity. Can you imagine getting a real PR from a human engineer you trust, but the description says "This pull request was sponsored by Skeezy Software Inc."?

Well, yes and no. What I mean is, being a related person who is indeed a person (by whatever means you establish that) and having some sort of standard by which you won't be bought, seems increasingly rare and therefore valuable. By "bought" I don't mean they won't sponsor stuff. I mean they've got a public standard that can be trusted to some degree. Your final example isn't exactly what I'm thinking of here. I'm th…

Digital human fortresses are totally becoming a thing.

For example, our community [0] asks you to submit an application before you're granted an invite code. If you attend a meetup in person we'll grant a "Verified Human" badge too. This gives you the power to invite others into the fortress: you're responsible for them.

The price to pay is steep because community growth is now glacial. It really does solve the slop problem though. (I'm also no longer convinced maximizing growth is Good.) Maybe there's some in-between solution for those who dislike invite-only spaces.

[0] https://handmadecities.com/chat

Re: We are retiring our bug bounty program

#205

Post by dotancohen »

CamperBob2 wrote: post #129
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

Then who arbitrates the inevitable dispute over whose end the problem was?

Re: We are retiring our bug bounty program

#206

Post by psychoslave »

CharlesW wrote: post #78
limaoscarjuliet wrote: post #27

Earlier quoted context omitted.

"[...] bottleneck isn't in writing the code. It is in reading and understanding the code". 100% agreed! Furthermore, the more code is generated by AI, the fewer people will actually understand it!

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

Precisely they are deterministic, so extrem cases apart, we could expect that given the documentation and a peace of code, engineers would most of the time be able to translate properly to assembly and explain what the assembly actually trigger in mechanical terms.

LLMs, as pushed currently, are not deterministic.

Moreover, I yet have to see a compiler whose output try to convince me I'm completely right and bring very smart interesting point on the table. Quite the contrary actually, though generally errors messages are not explicitly telling users how stupid the proposed code is as it doesn't even pass mere syntax and fundamental logic requirements.

Re: We are retiring our bug bounty program

#207

Post by caymanjim »

48terry wrote: post #178
caymanjim wrote: post #98

Earlier quoted context omitted.

There's no reason to care that a human spent time on it. Humans are bad at writing code. Garbage PRs and slop have been a problem in open source and bug bounty programs since long before AI came on the scene. We need better AI so that there's no need to solicit external bug fixes, and better AI so other contributions can be evaluated for usefulness and quality. What do you care if a human ever looked at it at all? It…

If AI is already mass-producing garbage PRs and other unreliable crap, what makes AI (established as producing unreliable crap) the solution for review? What makes the reviewing AI not produce unreliable crap with regards to the review? A magical, hypothetical AI that always gets it right and will make all these problems go away is neither a solution nor a plan. It's wishful thinking.

AI in the hands of the right people is incredibly powerful. A good team of engineers with AI doing their own bug-hunting on their own code is already far better than any outsider—human, AI, or human-assisted AI—could ever do. A good internal AI-assisted team is also the only thing that can vet all other contributions. It doesn't matter if those contributions are 100% human-written, 100% AI-written, or a combination. The problem is the same.

Unless you stop accepting outside contributions at all, there's simply no way to determine if a human was involved in the process. Any mandate that all contributions come from humans will fail because there's no detection or enforcement mechanism. You have to assume it's slop either way, and improve your ability to vet it. Only another AI can do that, because we don't have enough qualified humans to keep up.

Re: We are retiring our bug bounty program

#208

Post by DANmode »

hunterpayne wrote: post #154
hnthrow0287345 wrote: post #101

Earlier quoted context omitted.

I have seen precisely zero consequences for these people because they usually leave after not too long and go somewhere else, sometimes for higher pay. The slower folks end up getting the worse code and no raises in exchange for comradery. But also I have no idea how that situation arises unless the slower folks are just auto-approving PRs. You kind of did that to yourself if you let the new person get away with it.

My experience is exactly the opposite. The TT ends up being the last engineer standing a lot of the time. The people who want to have better refactoring and more maintainable code are usually the ones who move on. The TT often stays in the same place for 25 years. Often correcting mistakes they themselves made in the past. I knew one engineer who came in every Sunday night to process missed orders from an e-com syste…

Fix your last sentence while there’s still time, an otherwise super strong comment.

(Thank you.)

Re: We are retiring our bug bounty program

#209

Post by gobdovan »

cyclopeanutopia wrote: post #198
gobdovan wrote: post #193

I think a lot of this is exposing a change in assumed context, but it seems better to adapt to the new trends than discontinue security programs. AI lets good-faith bug hunters look through more repos they are not deeply familiar with. They may recognize a bad pattern quickly, almost like a very specialized static-analysis rule. But without project context, it is not always clear whether something is a real bug, a fo…

> It could also help to ask reporters to clarify how the bug was found so you let people set reasonable expectations: "AI-found and manually confirmed", "AI-assisted", or "no AI used". And why would they tell the truth?

It doesn't really require all people to tell the truth.

If the bug hunter is acting in good faith, they can communicate how much scrutiny they think their report deserves, which may reduce maintainer frustration.

If the bug hunter is acting in bad faith, and they claim "no AI used" but the report shows obvious AI-generated content, detectable by a classifier, maintainers can dismiss it more easily.

Re: We are retiring our bug bounty program

#210

Post by nottorp »

mackeye wrote: post #82
curtisblaine wrote: post #62

Bots are using real tokens for this. So, ultimate honeypot idea: post heavily commented skeleton code in a github repo, promise a generous money reward for closing issues and never pay anyone. See the bots swarm and burn their tokens to write code for you.

:D https://github.com/UnsafeLabs/Bounty-Hunters

Is there a description of this project on any other site? They clearly can't post it's bot bait on the git repo, and maybe not on the leaderboards site because it's linked from the repo.

But there must be some announcement about the project somewhere? I'd like to get that to pass it around.

Post reply on HN