Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

221–230 of 303 posts

Re: We are retiring our bug bounty program

#221

Post by ofjcihen »

hunterpayne wrote: post #186
Rover222 wrote: post #52

Earlier quoted context omitted.

The reality is somewhere in the middle. Features are shipping 2x to 5x faster at a lot of organizations, with solid code still being produced and reviewed. Anyone trying to suggest that AI hasn't sped up quality code production is just insisting on keeping their head in the sand, IMO.

I predict a golden age for security is coming soon to those organizations. Dude, we can all literally see your code crumbling in our web browsers.

For people like me it’s very much already here

Re: We are retiring our bug bounty program

#222

Post by jcgrillo »

datsci_est_2015 wrote: post #195
CharlesW wrote: post #78

Earlier quoted context omitted.

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

There’s a large difference between understanding precisely what some code does and understanding what code intends to do. It’s why “what happens when you begin typing into your web browsers address bar?” is such a powerful question for weeding out low quality interview candidates. I’ve never worked at Google, but I can talk about how they probably handle the incoming requests. I’ve never worked on Windows OS-level so…

> because that’s not how LLMs work

It's almost impossible to have a rational discussion about the effects of this technology because this point is so easily lost. Even super smart, credentialed, expert people easily (and often!) fall into the trap of anthropomorphizing the bot because it makes human noises. It's really important to remember the mechanical principles underlying its function. No different from any other computer program in that respect, the difference is the psychological hold it gets on the user. There is no intention behind its actions, but it's very easy to hallucinate one because with every other thing that speaks human language there is some intention behind the words and actions.

Re: We are retiring our bug bounty program

#223

Post by ofjcihen »

48terry wrote: post #187
andai wrote: post #153

I don't get it. Can't they ask Claude to check slop? This sounds like a bit of a baby/bathwater situation. (Okay Claude is too expensive, but Deepseek can probably handle it.)

How do you verify that Claude's output when checking slop is, in fact, correct, and not just more slop itself?

Sloppy turtles all the way down.

Re: We are retiring our bug bounty program

#224

Post by alexandra_au »

ryandrake wrote: post #118
Lalabadie wrote: post #45

Good time to mention this fantastic repo acting as a bot honeypot: https://github.com/UnsafeLabs/Bounty-Hunters The corresponding leaderboard: https://clankers-leaderboard.pages.dev

I don't understand this. If that project is not offering a bug bounty, why are they getting so many PRs? What possible incentive is there to spend real money on tokens just to push junk PRs? Are the PRs spamming a product or something?

They see it as an investment, they're basically shooting in the dark hoping they'll hit their target and get a bounty payout.

Re: We are retiring our bug bounty program

#225

Post by b65e8bee43c2ed0 »

ToucanLoucan wrote: post #24
jquery wrote: post #19

Earlier quoted context omitted.

I think people would be more interested in listening to "AI skeptics" if they offered realistic solutions to the problems they predict. Pandora's box has been opened, let's deal with the consequences now instead of trying to shut the box which cannot be shut.

> I think people would be more interested in listening to "AI skeptics" if they offered realistic solutions to the problems they predict. AI is the fucking problem. Yes, it has (some) uses. It is not nearly the number advertised. And more and more the median use case seems to be, again, overloading people actually trying to do work with an avalanche of bullshit. The solution is exactly what the linked article says: s…

>The solution is exactly what the linked article says: shut it down.

China says no. what are you going to do now, sanction it? =)

Re: We are retiring our bug bounty program

#226

Post by basilikum »

user_7832 wrote: post #37
MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Honestly I think this is a great idea. My only suggestion is instead of being very nominal, it should be "reasonable" (so $10 and not $1). It's even possible to directly link this to maintainers/employees - if you can review 10 such AI/real things per hour (likely more if it's AI slop that's easy to detect), you're generating another revenue stream. Now, I have no idea if these guys are based in SF Bay or a 3rd world…

If I had to desposit 10$ to report a vulnerability to a company that could get their entire production/business to halt, I'd publish the exploit.

Re: We are retiring our bug bounty program

#227

Post by sowbug »

adamtaylor_13 wrote: post #190
sowbug wrote: post #142

Earlier quoted context omitted.

There is hardly a bright line between real and fake. An influencer is just a person who rents out their identity. Can you imagine getting a real PR from a human engineer you trust, but the description says "This pull request was sponsored by Skeezy Software Inc."?

Well, yes and no. What I mean is, being a related person who is indeed a person (by whatever means you establish that) and having some sort of standard by which you won't be bought, seems increasingly rare and therefore valuable. By "bought" I don't mean they won't sponsor stuff. I mean they've got a public standard that can be trusted to some degree. Your final example isn't exactly what I'm thinking of here. I'm th…

I'm imagining a chart with two lines. Both have to do with verifying humanity online. The first line shows its cost. It increases dramatically over time. The other line shows its value. That one declines gradually, then falls off a cliff.

I think we're very close to those two lines crossing. Which is another way of saying that people might care today whether something was generated by/with AI, but I don't think they will care soon. Humans will still decide what gets created, but the how won't matter as much.

You might be right that the software equivalent of a sourdough-baking Reddit community will continue to exist. But most people will buy bread at the store and have no idea how it's made.

Re: We are retiring our bug bounty program

#228

Post by charcircuit »

curtisblaine wrote: post #62

Bots are using real tokens for this. So, ultimate honeypot idea: post heavily commented skeleton code in a github repo, promise a generous money reward for closing issues and never pay anyone. See the bots swarm and burn their tokens to write code for you.

Not paying people is not a "prank." You can be taken to court and forced to pay for their services rendered.

An ultimate honeypot would not give the creator so much financial liability for passing out "generous" rewards.

Re: We are retiring our bug bounty program

#229

Post by nixon_why69 »

dogleash wrote: post #113
nixon_why69 wrote: post #28

Earlier quoted context omitted.

Context is everything for massive PRs. If you don't ever have a massive PR from a dynamite session, then you cannot ever be better than "average and plodding". So the question is, what's the context of the massive PR and how should it be handled? * Mature product making money, intermediate engineer just refactored everything so it's "better"? Shut the fuck up, kindly please, you will have to demonstrate that you unde…

> If you don't ever have a massive PR from a dynamite session, then you cannot ever be better than "average and plodding". That's just cope to avoid learning how to turn a big change into a well organized patch series.

In retort, that's just doubling down that everything should always be average and plodding.

I'm not saying one shouldn't learn how to stage large changes into a mature codebase. Sometimes the overhead is very worth it, maybe most times if you're close to the profit center of a faang. But one should understand multiple ways of working, for different situations.

Re: We are retiring our bug bounty program

#230

Post by benatkin »

satvikpendem wrote: post #41

Has anyone used Turso in production? It's an SQLite compatible rewrite in Rust but with added features like multiple writer support and being open to external contributions which SQLite is not. I was thinking of using it for my full stack Rust apps just so everything works with cargo and I don't have to bring in SQLite separately.

Someone did a multi writer implementation that supports the sqlite3 protocol and has finer grained locking, just as a solo project.

https://x.com/doodlestein/status/2052910351474209258

Post reply on HN