Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

251–260 of 303 posts

Re: We are retiring our bug bounty program

#251

Post by xnx »

chapinb wrote: post #17
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

A True Engineer(TM) knows it is better to accomplish nothing correctly than to achieve something imperfectly.

Re: We are retiring our bug bounty program

#252

Post by umvi »

Aurornis wrote: post #122
MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

> Make submitters pay Asking people to pay to submit bugs would start a firestorm of internet drama about asking people to do free work for the company and pay for the privilege. It doesn’t matter if the program actually paid out. If they got even one report closed incorrectly we would never hear the end of it.

Honestly, depending on the repo, I would pay a reasonable fee to get issues or PRs I open seen. No different than paying a fee to add a new game to Steam - raises the barrier to entry and prevents a lot of garbage from entering the fray.

Re: We are retiring our bug bounty program

#253

Post by joe_mamba »

dotancohen wrote: post #202
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

> monetary friction is THE ONLY (anonymous) WAY to filter out serious people from bad actors How are monetary transactions anonymous?

It's not fully anonymous but partly.

Re: We are retiring our bug bounty program

#254

Post by basilgohar »

hnthrow0287345 wrote: post #101
chapinb wrote: post #17

Earlier quoted context omitted.

Sounds a like a tactical tornado, made me think of this paragraph: “Almost every software development organization has at least one developer who takes tactical programming to the extreme: a tactical tornado. The tactical tornado is a prolific programmer who pumps out code far faster than others but works in a totally tactical fashion. When it comes to implementing a quick feature, nobody gets it done faster than the…

I have seen precisely zero consequences for these people because they usually leave after not too long and go somewhere else, sometimes for higher pay. The slower folks end up getting the worse code and no raises in exchange for comradery. But also I have no idea how that situation arises unless the slower folks are just auto-approving PRs. You kind of did that to yourself if you let the new person get away with it.

Sometimes the issues emerge later. The code doesn't scale well, it has subtle bugs that crop-up later, it doesn't handle edge cases well. Basically, it answers the immediate issue well, but it is poorly engineered and hence, why it causes problems for others down the line.

Re: We are retiring our bug bounty program

#255

Post by fidelramos »

mort96 wrote: post #244
rvz wrote: post #211

Earlier quoted context omitted.

Very tough question. Stablecoins?

Didn't people realize that those automated pegging algorithms don't really work after the last round of stablecoin collapses

At least DAI is holding well. It existed before LUNA and it continues to work today.

Re: We are retiring our bug bounty program

#258

Post by 6thbit »

How about a real/false prediction market of sorts instead of a bounty program and let the public bet on the answer, everyone uses their own tokens to try and verify the report's substance and buys bets on it, if the majority yields False, the house wins, majority real house pays.

joking, but maybe not?

Re: We are retiring our bug bounty program

#259

Post by Uvix »

Neywiny wrote: post #161
Uvix wrote: post #91

Earlier quoted context omitted.

Why not leave your functions but have them invoke the libraries instead?

They weren't drop in replacements. They were actually easier. Made up example: > setup_terminal(); enable_input(); while(...) inp = read_character(); ..... vs > readline() So yes I could've stubbed out the other stuff and replaced just one, but that's just adding tech debt

That makes sense. Thanks for explaining!

Re: We are retiring our bug bounty program

#260

Post by autoexec »

goalieca wrote: post #114
joe_mamba wrote: post #90

Earlier quoted context omitted.

But it really doesn't have to be like this. For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled…

The bots spam even when there's no bug bounty program. The emails start out with "I received $500 for a similar reported on another site"

Thankfully the number of beg bounties I've seen has been stable so far. Maybe they're just devoting most of their time on the places that openly promise money.
Post reply on HN