Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

261–270 of 271 posts

Re: cURL removes bug bounties

#261

Post by notepad0x90 »

rcxdude wrote: post #258
notepad0x90 wrote: post #168

This is silly, people don't need AI to send you garbage. If your project is getting lots of junk reports, you should take it as a good sign, that people are looking at it a lot now. You don't remove the incentive, you ask for help to triage the junk. Curl is a popular and well supported tool, if it needs help in this area, there will be a long line of competent people not volunteering their time and/or money. If you…

Curl did already tend to get a decent number of junk reports from people who just didn't know what they were doing, but this was limited to the number of productive idiots who focused their productivity on curl specifically. AI allows significantly less motivated idiots to create substantially more workload, and therefore upgrades this phenomenon from a minor annoyance to a big problem, one that may just render publi…

My point was #1 that it is a volume problem, and #2, you don't need maintainers to triage bugs and prs, even bots can do that for simpler things. They can have a pool of project members to upvote a bug report before maintainers look at it.

Re: cURL removes bug bounties

#262

Post by empath75 »

memesarecool wrote: post #190

Hackerone (where cURL hosted their bounty program) tracks the reputation of bounty hunters. I don't understand why they are not taking advantage of this. Make a private program, invite only hackers who have proved themselves by submitting relevant reports.

https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...

most of them are new users or will just create a new account if their reputation gets hit.

Re: cURL removes bug bounties

#263

Post by empath75 »

Snakes3727 wrote: post #33

The company I work for has a pretty bad bounty system (basically a security@corp email). We have a demo system and a public API with docs. We get around 100 or more emails a day now. Most of it is slop, scams, or my new favourite AI security companies sending us an AI generated pentest un prompted filled with false positives, untrue things, etc. It has become completely useless so no one looks at it. I had a sales re…

I had a customer _turn off an entire kubernetes cluster in production_ because of a single hallucinated security finding.

Re: cURL removes bug bounties

#264

Post by Draiken »

colechristensen wrote: post #232
Draiken wrote: post #148

Earlier quoted context omitted.

Yet this is not reproducible. This is the whole issue with LLMs: they are random. You cannot trust that it'll do a good job on all reports so you'll have to manually review the LLMs reports anyways or hope that real issues didn't get false-negatives or fake ones got false-positives. This is what I've seen most LLM proponents do: they gloss over the issues and tell everyone it's all fine. Who cares about the details?…

Is it not reproducable? Someone up thread reproduced it and expanded on it. It worked for me the first time I prompted. Did you try it or are you just guessing that it's not reproducable because that's what you already think? I'm not talking about completely replacing humans, the goal of this exercise was demonstrating how to use an LLM to filter out garbage. Low quality semi-anonymous reports don't deserve a whole l…

> Is it not reproducable? Someone up thread reproduced it and expanded on it. It worked for me the first time I prompted. Did you try it or are you just guessing that it's not reproducable because that's what you already think?

I assumed you knew how LLMs work. They are random by nature, not "because I'm guessing it". There's a reason if you ask the LLM the same exact prompt hundreds of times you'll get hundreds of different answers.

>I looked for, found, and shared evidence

Anecdotal evidence. Studies have shown how unreliable LLMs are exactly because they are not deterministic. Again, it's a fact, not an opinion.

>I'm talking about filtering spammy communication channels

So if we make tons of mistakes there, who cares, right?

I only used this as an example because it's one of the few very public uses of LLMs to make judgement calls where people accepted it as true and faced consequences.

I'm sure there are plenty more people getting screwed over by similar mistakes, but folks generally aren't stupid enough to say that publicly. Maybe the Salesforce huge mistake qualifies too? Incidentally it also involved people's jobs.

Regardless, the point stands: they are unreliable.

Want to trust LLMs blindly for your weekend project? Great! The only potential victim for its mistakes is you. For anything serious like a huge open source project? That's irresponsible.

Re: cURL removes bug bounties

#265

Post by cestith »

arionmiles wrote: post #236
cestith wrote: post #205

Earlier quoted context omitted.

In particular a place I used to work had a plugin for threaded comments in Jira. The specific one we were using slowed things down noticeably with the DB on the same server, but not too much to be an improvement in overall usefulness. Then we decided trying to make our Jira more reliable by splitting the DB out into a separate clustered DB system in the same data center. The latency difference going through a couple…

You're referring to the on-prem Jira. That might suck, sure. My experience has been purely using Jira Cloud and Confluence Cloud, both of which I've found to be snappy and responsive.

My last company switched several teams to Jira Cloud. My current company started with Cloud when we moved over from other tools.

Cloud does not give you the flexibility of your own plugins, your own redundancy design, or your own server upgrades. On top of that, the performance is pretty variable and is far worse than a self-hosted Jira on fast hardware.

It’s interesting to me that your lack of experience to make a comparison qualifies you in some way to criticize the experience I actually have.

Re: cURL removes bug bounties

#266

Post by cestith »

capitainenemo wrote: post #240
arionmiles wrote: post #236

Earlier quoted context omitted.

You're referring to the on-prem Jira. That might suck, sure. My experience has been purely using Jira Cloud and Confluence Cloud, both of which I've found to be snappy and responsive.

Amusingly, exactly opposite experience here. That said, our on-prem is jira and confluence integrated with db on same machine, and apache in front doing additional caching. I imagine like so many things it is how you set it up...

If you read my previous comment, I said it was largely the specific poor plugin that caused most of the performance issue with the database queries. I never complained about the overall speed of on-prem Jira. That was the assertion of the person who’s only ever used the cloud version.

Re: cURL removes bug bounties

#267

Post by usrbinbash »

notepad0x90 wrote: post #260
usrbinbash wrote: post #259

Earlier quoted context omitted.

The point is that "can happen without [THING] as well" does not mean the argument "[THING]s existence exacerbates the problem" is wrong.

No, the implication that "THING" is the cause of something and therefore something needs to be done must withstand the scrutiny of "other THINGS" also causing that thing, and therefore the solution is attacking either only one cause or not the real root cause. The fact that bad reports have to be triage doesn't change with AI. What changed is the volume, clearly. So the reasonable response is not to blame "AI" but to…

> What changed is the volume, clearly.

The change in volume was the tipping point between bug bounties being offered and devs being able to handle bad reports, and bug bounty nixed because devs no longer willing to handle the floos.

And the root cause for the change in volume is generative AI.

So yes, this is causally related.

> The problem doesn't change because of who is causing it in this case.

Wrong.

Because SCALE MATTERS. Scale is the difference between a few pebbles causing a minor inconvenience, and a landslide destroying a house.

So whatever makes the pebbles become a landslide, changed the problem. Completely.

Re: cURL removes bug bounties

#268

Post by ndriscoll »

anileated wrote: post #163
TeMPOraL wrote: post #156

Earlier quoted context omitted.

> I have to imagine this ideology was developed with humans in mind. Actually, you don't have to. You just want to. N=1 but to me, LLMs are a perfect example of where the "ideology embedded into the GPL" benefits the world. The point of Free Software isn't for developers to sort-of-but-not-quite give away the code. The point of Free Software is to promote self-sufficient communities . GPL through its clauses, particu…

Something can be illegal and it can be technically legal but at the same time pretty damn bad. There is the spirit and the letter of the law. They can never be in perfect agreement because as time goes bad guys tend to find new workarounds. So either the community behaves, or the letter becomes more and more complicated trying to be more specific about what should be illegal. Now that GPL is trivially washed by askin…

LLMs spitting out GPL code seems perfectly inline with the spirit to me. The goal is to make it so that users have the freedom to make software behave in ways that suit them. Things kicked off when some printer could not be made to work correctly because of its proprietary drivers. LLMs are a huge multiplier for that: now even people who don't know how to program can customize their software! We're already approaching (or at?) the point where local agents on commodity hardware (like a few $thousand worth of GPUs, which was the nominal cost of a 90s PC) are able to make whatever changes you want given the correct feedback loops. Sounds good to me.

Re: cURL removes bug bounties

#269

Post by notepad0x90 »

usrbinbash wrote: post #267
notepad0x90 wrote: post #260

Earlier quoted context omitted.

No, the implication that "THING" is the cause of something and therefore something needs to be done must withstand the scrutiny of "other THINGS" also causing that thing, and therefore the solution is attacking either only one cause or not the real root cause. The fact that bad reports have to be triage doesn't change with AI. What changed is the volume, clearly. So the reasonable response is not to blame "AI" but to…

> What changed is the volume, clearly. The change in volume was the tipping point between bug bounties being offered and devs being able to handle bad reports, and bug bounty nixed because devs no longer willing to handle the floos. And the root cause for the change in volume is generative AI. So yes, this is causally related. > The problem doesn't change because of who is causing it in this case. Wrong. Because SCAL…

How can you say "wrong." and then go on to say scale matters, that means scale is the problem, not who is reporting it, you contradicted yourself.

We're in agreement that it is a scale issue. When something needs to scale, you address the scale problem. Obviously the devs can't handle this volume, and I agree with that there too. Our disagreement is the response.

I guarantee that if they asked for volunteers they'll get at least 100 within a week. They can filter by previous bug triage experience and experience with C and the code base. My suggestion is to let people other than the devs triage bug reports, that will resolve the scale problem. curl devs never have to see a bug not triaged by a human they've vetted. There is also no requirement on their part to respond to a certain number of bug reports, so with or without help, they can let the stack pile up and it will still be better than nothing.

Re: cURL removes bug bounties

#270

Post by anileated »

ndriscoll wrote: post #268
anileated wrote: post #163

Earlier quoted context omitted.

Something can be illegal and it can be technically legal but at the same time pretty damn bad. There is the spirit and the letter of the law. They can never be in perfect agreement because as time goes bad guys tend to find new workarounds. So either the community behaves, or the letter becomes more and more complicated trying to be more specific about what should be illegal. Now that GPL is trivially washed by askin…

LLMs spitting out GPL code seems perfectly inline with the spirit to me. The goal is to make it so that users have the freedom to make software behave in ways that suit them. Things kicked off when some printer could not be made to work correctly because of its proprietary drivers. LLMs are a huge multiplier for that: now even people who don't know how to program can customize their software! We're already approachin…

> LLMs spitting out GPL code seems perfectly inline with the spirit

Only if spitted out code is GPL-licensed, which it isn't.

Post reply on HN