Why did “AI slop” disappear from the title?
Probably because it wasn't in the actual submission title.
cURL removes bug bounties
211–220 of 271 posts
Re: cURL removes bug bounties
#212Hackerone (where cURL hosted their bounty program) tracks the reputation of bounty hunters. I don't understand why they are not taking advantage of this. Make a private program, invite only hackers who have proved themselves by submitting relevant reports.
Say all projects did just that, only allowing reports from proven hackers. How does a new hacker then prove themselves?
Re: cURL removes bug bounties
#213An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…
> I've since learned that anything heavily regulated like hospitals and banks will have security procedures catering to compliance, not actual security. Sadly, yeah. And will do anything only if they believe they can actually be caught. An EU-wide bank I used to be customer of until recently, supported login with Qualified Electronic Signatures, but only if your dongle supports... SHA-1. Mine didn't. It's been deprec…
Name and shame, and give them a trial by media.
Re: cURL removes bug bounties
#214Earlier quoted context omitted.
Technically true but that argument also won't let you bring your gun on a plane.
The purpose of a tool is important. Guns have no other purpose than doing harm. E.g. We don't blame cars, the tool, for driving into a gathering of people that can kill a dozen of them, we blame the driver. The purpose is transport, the same way LLMs for coding are a tool for assisting coding tasks.
> The purpose of a tool is important.
> Guns have no other purpose than doing harm.
Objects don't have purposes or intent until people use them, and many objects have multiple reasonable and dual purposes. Objects can be used for net good and net harm. A bow and arrow isn't specifically for harming humans but can be used for such. Chainsaws and meat cleavers too.
What would you like a machine gun-wielding terrorist to be stopped with? A strongly-worded letter?
On the same token of reasonableness and rationality, it's unreasonable to give a toddler a towed howitzer that's ordinarily destined for Big Sandy Shoot.
Re: cURL removes bug bounties
#215Earlier quoted context omitted.
Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk. Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was bef…
Real risk is missed security issue
You’re not addressing any of the points made.
Re: cURL removes bug bounties
#216Alternate headline: AI discovering so many exploits that cybersecurity can't keep up Am I doing this right?
There is a difference between AI discovering real vulnerabilities (e.g. the ffmpeg situation), and AI being used to spam fake vulnerabilities
> the ffmpeg situation
How do you know that?
Re: cURL removes bug bounties
#217An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…
Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk. Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was bef…
Indeed. I've also gotten a lot of "Hey I found a super critical security bug that makes your system ass, but if you pay me first I'll tell you what it is" types of submissions. Sometimes it's a hybrid, like something semi-legitimate but weak that they disclose up front, closing with a "and I've got another one that's juicy but you have to pay me first to hear it".
Oh and then of course there is the flood of people who just scanned our infra with Nessus and screenshotted part of the report (often with important details blacked out so we can't see them unless we pay).
As someone who has been on both sides of it as well, it just feels like everything is terrible
Re: cURL removes bug bounties
#218Earlier quoted context omitted.
Banks aren't even liable for losses from account takeovers, at least if their system is compliant, regardless of whether that makes it secure. Their biggest incentive is customer satisfaction, which fraud does hurt. It's credit cards that have to reimburse for fraud, but they charge the merchant for it, plus fees, so they have absolutely no incentive to prevent fraud, if not an incentive to outright encourage fraud.…
> Their biggest incentive is customer satisfaction At a bank ? No way. They are some of the most customer-hostile organizations I've interacted with. Dealing with payment accounts is a necessary evil for them, and they are very much aware of the effort required to switch to a different bank, and of the massive regulatory moat preventing consumer-friendly competition from popping up. A bank doesn't care about screwing…
Case in point: Wells Fargo foreclosure fraud.
Case in point: Wells Fargo opening new accounts in customer names without direction from, approval by, or notification to said customers.
The primary incentive of a bank is to make money rather than customer satisfaction, security, or most other things. Sometimes other priorities suffer in the race to profit, sometimes including regulatory compliance and legality.
Re: cURL removes bug bounties
#219Earlier quoted context omitted.
Technically true but that argument also won't let you bring your gun on a plane.
The purpose of a tool is important. Guns have no other purpose than doing harm. E.g. We don't blame cars, the tool, for driving into a gathering of people that can kill a dozen of them, we blame the driver. The purpose is transport, the same way LLMs for coding are a tool for assisting coding tasks.
Technically an LLM is a tool for extracting candidate responses to plain-text requests. Since (textual) programming languages are languages, they can create passable candidate responses to queries about those. Certain LLMs such as Copilot and Claude have had their training focused a bit more towards programming tasks, but saying that LLMs as a class are for coding assistance is a little narrowly stated.
It would maybe be handy to feed the responses from an LLM through a computational reasoning engine to grade a few of them.
Re: cURL removes bug bounties
#220It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code
It has also really accelerated the army of hustlers who can't actually code but want to get a contributor badge on major repos to put on their resume. It's not like this sort of hustling didn't exist prior to LLMs but the volume has ballooned massively.
Any system of cheaply generating mediocre quality inherently benefits spammers and grifters more than anyone else.
Their biggest limiting factor is always the cost of generating mediocre content. Removing that barrier was the dumbest thing to do in the world.