Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

211–220 of 303 posts

Re: We are retiring our bug bounty program

#211

Post by rvz »

mort96 wrote: post #95
rvz wrote: post #80

Earlier quoted context omitted.

There are many cryptocurrencies that allow anyone to move money quickly, cheaply, and on the same day in less than a minute and requires zero bank accounts. At this point there isn't an excuse.

And which are trivial to convert back and forth between real money and cryptocurrency? And hold their value with sufficient stability that you can convert USD into the currency, make a transaction, wait a few weeks, make a transaction the other direction and then convert back into USD, with roughly no loss in value?

Very tough question. Stablecoins?

Re: We are retiring our bug bounty program

#212

Post by 48terry »

caymanjim wrote: post #207
48terry wrote: post #178

Earlier quoted context omitted.

If AI is already mass-producing garbage PRs and other unreliable crap, what makes AI (established as producing unreliable crap) the solution for review? What makes the reviewing AI not produce unreliable crap with regards to the review? A magical, hypothetical AI that always gets it right and will make all these problems go away is neither a solution nor a plan. It's wishful thinking.

AI in the hands of the right people is incredibly powerful. A good team of engineers with AI doing their own bug-hunting on their own code is already far better than any outsider—human, AI, or human-assisted AI—could ever do. A good internal AI-assisted team is also the only thing that can vet all other contributions. It doesn't matter if those contributions are 100% human-written, 100% AI-written, or a combination.…

That didn't actually address my comment or question, so I'll repeat it, I guess.

We already know AI is spamming unreliable crap and slop. The apparent solution is "more, better AI".

Why wouldn't this AI for screening all this also produce crap and slop?

Is the plan there "AI but it actually works right and doesn't produce crap and slop"?

Re: We are retiring our bug bounty program

#213

Post by hnlmorg »

CamperBob2 wrote: post #129
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary.

You could probably adjust the cost per region, but then you open yourself up to spam bots again because it’s trivial to spoof one’s location.

Re: We are retiring our bug bounty program

#214

Post by [deleted] »

chapinb wrote: post #17
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

[deleted]

Re: We are retiring our bug bounty program

#215

Post by DANmode »

pdimitar wrote: post #84
satvikpendem wrote: post #73

Earlier quoted context omitted.

It can be a company wide policy rather than trying to target a single individual even if the outcome is that they are targeted. This is something that should be addressed to them through a manager etc or if not, it's time to leave while they ruin the product over time.

This "you should leave" thing is a very boring and tired take and it should be said regularly that almost no engineer can afford it nowadays. Beautiful theory, but only that.

> it should be said regularly that almost no engineer can afford it nowadays.

Everybody is not you.

The market is bleak - but don’t mistake everyone’s leverage - or understanding their leverage - for your own.

Re: We are retiring our bug bounty program

#216

Post by pdimitar »

DANmode wrote: post #215
pdimitar wrote: post #84

Earlier quoted context omitted.

This "you should leave" thing is a very boring and tired take and it should be said regularly that almost no engineer can afford it nowadays. Beautiful theory, but only that.

> it should be said regularly that almost no engineer can afford it nowadays. Everybody is not you. The market is bleak - but don’t mistake everyone’s leverage - or understanding their leverage - for your own.

Same can be said back to you. Obviously mine and 50+ acquaintances experience is not the entire world but geographical clusters and/or work-area clusters do apply.

Can you pick up the phone and be in the next job the next week?

Re: We are retiring our bug bounty program

#217

Post by pkulak »

abirch wrote: post #25
chapinb wrote: post #17

Earlier quoted context omitted.

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

AI can be the ultimate tactical tornado.

Yup, this was my first thought. Tell an LLM that there's a bug, and it will _happily_ add 200 lines to the project, usually wrapped in if statements so that it all interleaves with existing code. Then it will write twice as many lines in tests, run it all, and be done. Your bug is fixed. All the tests run, and test coverage went up. Now do that a couple dozen more times. :shudder:

Re: We are retiring our bug bounty program

#218

Post by alexandra_au »

Philip-J-Fry wrote: post #108
hnthrow0287345 wrote: post #101

Earlier quoted context omitted.

I have seen precisely zero consequences for these people because they usually leave after not too long and go somewhere else, sometimes for higher pay. The slower folks end up getting the worse code and no raises in exchange for comradery. But also I have no idea how that situation arises unless the slower folks are just auto-approving PRs. You kind of did that to yourself if you let the new person get away with it.

I can tell you how that situation comes about. You start by rejecting those PRs, saying "write more maintainable code, not quick hacks". Management starts pressuring the original developer "why is it not merged yet, I thought you had it working". That developer hits back with "well, it failed code review, they want me to refactor it". Management goes back to the reviewer, "why did you fail this? It meets coding stand…

>You start by rejecting those PRs, saying "write more maintainable code, not quick hacks".

How do you go about that when for example, my previous employer just allowed any software developer to commit to any branch, and there was never any code review happening?

Re: We are retiring our bug bounty program

#219

Post by caymanjim »

48terry wrote: post #212
caymanjim wrote: post #207

Earlier quoted context omitted.

AI in the hands of the right people is incredibly powerful. A good team of engineers with AI doing their own bug-hunting on their own code is already far better than any outsider—human, AI, or human-assisted AI—could ever do. A good internal AI-assisted team is also the only thing that can vet all other contributions. It doesn't matter if those contributions are 100% human-written, 100% AI-written, or a combination.…

That didn't actually address my comment or question, so I'll repeat it, I guess. We already know AI is spamming unreliable crap and slop. The apparent solution is "more, better AI". Why wouldn't this AI for screening all this also produce crap and slop? Is the plan there "AI but it actually works right and doesn't produce crap and slop"?

I did address it: AI in the hands of the right people.

Random contributions to bug bounty programs or random PRs for new features come from all corners: expert engineers producing fantastic code; intermediate engineers trying their hardest but producing mediocre code; junior engineers wasting everyone's time with ill-conceived poorly-written code; and all of the above with varying amounts of AI assistance. And now also purely-automated AI, where the only human involved is pointing their AI at GitHub with no guidance.

You can't stop it on the inbox side. Either you turn the inbox off, or you leverage AI to help you separate the wheat from the chaff.

Re: We are retiring our bug bounty program

#220

Post by micromacrofoot »

replwoacause wrote: post #196
micromacrofoot wrote: post #65

Earlier quoted context omitted.

for every person that's hyping AI there are another 10 just using it to get stuff done without talking about it incessantly

I'm using it to do harder work and more of it for my employer for the same pay.

that's the spirit champ, surely management will notice soon and reward our fervor
Post reply on HN