Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

271–280 of 303 posts

Re: We are retiring our bug bounty program

#271

Post by DANmode »

ethanrutherford wrote: post #241
DANmode wrote: post #215

Earlier quoted context omitted.

> it should be said regularly that almost no engineer can afford it nowadays. Everybody is not you. The market is bleak - but don’t mistake everyone’s leverage - or understanding their leverage - for your own.

> Everybody is not you Perfect example of a non-sequitur. Irrespective of whether or not the statement is true, it has no bearing on the veracity of the original claim: that in the current market, the majority of workers simply do not have this leverage.

The original claim wasn’t “the majority of workers”, though.

I likely would have avoided commenting, if it was.

The original claim was “almost no engineer”.

Anyway, the point is, if you take little interest in the “full stack” of whatever you’re working on (the technical stack, BizDev, whatever),

you will obviously be easier to replace with an automaton - AI or human.

Re: We are retiring our bug bounty program

#272

Post by nightpool »

Neywiny wrote: post #199
nightpool wrote: post #128

Earlier quoted context omitted.

Arbitrary demarcations can still be valuable! Just because something is arbitrary doesn't mean that it's not helpful. Working in chunks will let you take more time to review each callsite individually, and increase your confidence in the changes In the future, I would definitely encourage you to explore a more iterative solution—fix the first 50 occurrences first, or maybe all the occurrences of a handful of function…

Well another problem is that there was a developer also working on those functions at the same time. So just like the recent post on a 25 million LoC reformat done in a weekend, it seemed better to do it in one fell swoop. If it's good enough at 25 million, I'm sure it's good enough at a few thousand

Autoformatters are deterministic tools that are tested regularly, with extensive test suites and went through a very long process of production usage and review before the reformat:

    > We also built a tool to diff ripper trees across formatted files, accounting for things like rubyfmt converting single quotes to double quotes. Combined with our extensive test suite, we built confidence slowly and deliberately.
If an autoformatter is working right, it's only changing whitespace—not the actual code executed. Changing between two different implementations of the same function is very different from changing whitespace around.

They also didn't do the entire thing in one weekend—that was just the article title clickbait. they did it file by file, incrementally, over the course of months:

    > Rolling out a novel autoformatter to 25 million lines of code has two big risks: merge conflicts and correctness. A bug affecting just 0.01% of lines would still touch tens of thousands of files. To manage both, we built in a per-file opt-in so rubyfmt would only format files that explicitly asked for it. Following the Developer Productivity org’s typical pattern, we started with systems we owned and could observe closely, then expanded coverage gradually as our confidence grew.
^ See how they talk about the incremental changes it took? This is what mature refactors look like. And they were only changing whitespace!

Re: We are retiring our bug bounty program

#273

Post by DANmode »

pdimitar wrote: post #216
DANmode wrote: post #215

Earlier quoted context omitted.

> it should be said regularly that almost no engineer can afford it nowadays. Everybody is not you. The market is bleak - but don’t mistake everyone’s leverage - or understanding their leverage - for your own.

Same can be said back to you. Obviously mine and 50+ acquaintances experience is not the entire world but geographical clusters and/or work-area clusters do apply. Can you pick up the phone and be in the next job the next week?

Coming off of a health sabbatical, yes, I have more contracted work around than I can commit to.

I can’t even imagine having 50 acquaintances I see in a year, currently, so I don’t know I’ll be able to offer advice specifically…

but generally?, I think I’d be pretty upset if I knew 50 people and none of them would bring me on their team, or start something up with me.

Re: We are retiring our bug bounty program

#274

Post by Rover222 »

hunterpayne wrote: post #186
Rover222 wrote: post #52

Earlier quoted context omitted.

The reality is somewhere in the middle. Features are shipping 2x to 5x faster at a lot of organizations, with solid code still being produced and reviewed. Anyone trying to suggest that AI hasn't sped up quality code production is just insisting on keeping their head in the sand, IMO.

I predict a golden age for security is coming soon to those organizations. Dude, we can all literally see your code crumbling in our web browsers.

okay dude, or maybe you're out of the loop

Re: We are retiring our bug bounty program

#275

Post by Rover222 »

esafak wrote: post #94
Rover222 wrote: post #52

Earlier quoted context omitted.

The reality is somewhere in the middle. Features are shipping 2x to 5x faster at a lot of organizations, with solid code still being produced and reviewed. Anyone trying to suggest that AI hasn't sped up quality code production is just insisting on keeping their head in the sand, IMO.

They're just working at companies with mature products where people are in meetings all day -- they say so! Startups very much want to crank shit out faster.

Startups that don't leverage AI are just getting crushed and/or not funded.

Re: We are retiring our bug bounty program

#276

Post by pdimitar »

DANmode wrote: post #273
pdimitar wrote: post #216

Earlier quoted context omitted.

Same can be said back to you. Obviously mine and 50+ acquaintances experience is not the entire world but geographical clusters and/or work-area clusters do apply. Can you pick up the phone and be in the next job the next week?

Coming off of a health sabbatical, yes, I have more contracted work around than I can commit to. I can’t even imagine having 50 acquaintances I see in a year, currently, so I don’t know I’ll be able to offer advice specifically… but generally ?, I think I’d be pretty upset if I knew 50 people and none of them would bring me on their team, or start something up with me.

Well, I am upset. But -- bubbles. My health has been in decline for years and I am very slowly making some strides. Missed on a million networking opportunities by being unable to go to conferences and... yeah, I'll not turn this into a sob story.

LLMs really accentuated the importance of networking, did they not?

Re: We are retiring our bug bounty program

#277

Post by HeyLaughingBoy »

alexandra_au wrote: post #218
Philip-J-Fry wrote: post #108

Earlier quoted context omitted.

I can tell you how that situation comes about. You start by rejecting those PRs, saying "write more maintainable code, not quick hacks". Management starts pressuring the original developer "why is it not merged yet, I thought you had it working". That developer hits back with "well, it failed code review, they want me to refactor it". Management goes back to the reviewer, "why did you fail this? It meets coding stand…

>You start by rejecting those PRs, saying "write more maintainable code, not quick hacks". How do you go about that when for example, my previous employer just allowed any software developer to commit to any branch, and there was never any code review happening?

Set rules on the repo. For example, no one on my project is allowed to check in code unless it's on a PR that's been reviewed and approved by at least two people. Attempting to push to /main will just fail otherwise.

Re: We are retiring our bug bounty program

#278

Post by theragra »

pscanf wrote: post #59

We sorely need a way to reliably detect AI slop, but unfortunately it doesn't seem possible and it's just getting harder and harder. Last month I tried my hand at finding a way to tell whether an OSS project is slop or not, based on the amount of "human attention" it received vs the amount of code it contains. The idea is that a 100k LOC project which received 3 days' worth of attention from a human is most certainly…

You by default assume all AI code is slop? This seems like an approach that won't be beneficial to the OSS overall.

What I found is

1. With LLMs, I was finally able to find time and confidence to contribute a patch. Before, contributing to established project seemed impossible with an amount of guidelines to follow and insider knowledge to have.

2. Many small isolated parts do not require some great code. Just glue, tying libraries together allows producing new features in existing apps. With some cars, it is possible even if I don't know the languages and libraries used.

Re: We are retiring our bug bounty program

#279

Post by rvz »

mort96 wrote: post #266
rvz wrote: post #256

Earlier quoted context omitted.

Except not all stablecoins are the same.

They essentially are to me, because I don't know how to differentiate them. Before the collapse, I would not have been able to look at the ones which collapsed and the ones which didn't and predict the outcome.

USDC operates as a fiat-backed stablecoin and is fundamentally different [0] to an algorithmic stablecoin such as UST which was the one that collapsed in 2022.

[0] https://www.usdc.com/learn/fiat-backed-vs-algorithmic-stable...

Re: We are retiring our bug bounty program

#280

Post by nitwit005 »

adamtaylor_13 wrote: post #93

Being a verifiable human identity (not as-in age verification or whatever) but as in having a known, public, reputation online will go a long way in this new slop-first world.

People would see it as a goal to have the worst reputation score. There are online troll accounts tied to real identities. They seem fine being known as someone causing frustration.
Post reply on HN