Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

291–300 of 303 posts

Re: We are retiring our bug bounty program

#291

Post by gwbas1c »

ethanrutherford wrote: post #236
gwbas1c wrote: post #124

Earlier quoted context omitted.

> Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. No, it's that quite literally the PR submissions are SPAMmed. Whoever made them is acting like a SPAMmer, sending out lots of garbage and hoping it sticks. IE, they're not doing their part in reviewing what the AI found and generated.

So you agree. Unless you're using some definition of "reviewing" which somehow doesn't involve "reading and understanding".

No, reading and understanding is not the bottleneck.

Whoever is running the AI is spamming instead of doing the actual work. IE, they are just pushing their work onto the people who would review legitimate submissions.

Re: We are retiring our bug bounty program

#292

Post by user_7832 »

basilikum wrote: post #226
user_7832 wrote: post #37

Earlier quoted context omitted.

Honestly I think this is a great idea. My only suggestion is instead of being very nominal, it should be "reasonable" (so $10 and not $1). It's even possible to directly link this to maintainers/employees - if you can review 10 such AI/real things per hour (likely more if it's AI slop that's easy to detect), you're generating another revenue stream. Now, I have no idea if these guys are based in SF Bay or a 3rd world…

If I had to desposit 10$ to report a vulnerability to a company that could get their entire production/business to halt, I'd publish the exploit.

Presumably you could do it just fine without paying if you didn't want the $1000 necessarily. Reasonably they'd still give you the $1000 even if you said "I don't want the money but you guys have a problem", and they later figure out you're not a bot and you're actually right.

Re: We are retiring our bug bounty program

#293

Post by DANmode »

pdimitar wrote: post #286
DANmode wrote: post #283

Earlier quoted context omitted.

A few questions that may help your next steps: 1.) What do you have to be doing, daily, weekly, to be happy? 1a.) What do you have to NOT be doing, daily, weekly, to be happy? 2.) Do you prefer to remain an individual contributor, for one reason or another? Said another way: are you the right fit to seriously look at the path to management or consulting roles? 3.) You mentioned your bubble - a few times. Are you will…

> 1.) What do you have to be doing, daily, weekly, to be happy? Be more in nature. I am in a tight metropolitan area and I hate my immediate surroundings. I've seen our multiple parks many times and I am not impressed. I'd prefer go hiking but my health condition is making me tired after a grocery shopping. Mind you, that is fixable but work is strangling me to the point of me not wanting to work out. Also, just gett…

> No idea why I even confessed as much but I still know enough to trust my intuition

These comments help others to process their situations

as much as us our own.

Thank you.

Re: We are retiring our bug bounty program

#294

Post by jcgrillo »

ToucanLoucan wrote: post #151
bcjdjsndon wrote: post #144

Earlier quoted context omitted.

> It's eminently possible, you just don't like the idea of it. Sounds like you can't accept AI is here to stay

"I shit on your floor, guess you have to get used to shit on your floor" No. You go out the door, and then I clean it up, and you don't get invited back. That's how that works.

Couldn't have said it better myself.

Re: We are retiring our bug bounty program

#295

Post by mort96 »

rvz wrote: post #279
mort96 wrote: post #266

Earlier quoted context omitted.

They essentially are to me, because I don't know how to differentiate them. Before the collapse, I would not have been able to look at the ones which collapsed and the ones which didn't and predict the outcome.

USDC operates as a fiat-backed stablecoin and is fundamentally different [0] to an algorithmic stablecoin such as UST which was the one that collapsed in 2022. [0] https://www.usdc.com/learn/fiat-backed-vs-algorithmic-stable...

Forgive me but I don't find this very convincing. Crypto shills were saying the same things about UST before its collapse. The technical details differed, but the arrogant tone and firm insistence that nothing bad could possibly happen was the same.

Re: We are retiring our bug bounty program

#296

Post by rvz »

mort96 wrote: post #295
rvz wrote: post #279

Earlier quoted context omitted.

USDC operates as a fiat-backed stablecoin and is fundamentally different [0] to an algorithmic stablecoin such as UST which was the one that collapsed in 2022. [0] https://www.usdc.com/learn/fiat-backed-vs-algorithmic-stable...

Forgive me but I don't find this very convincing. Crypto shills were saying the same things about UST before its collapse. The technical details differed, but the arrogant tone and firm insistence that nothing bad could possibly happen was the same.

> Forgive me but I don't find this very convincing.

I don't really need to convince you. I just look at how it's being tested and which companies are using it today.

But the main point I'm bringing is that stablecoins exist and the most trusted one USDC is used today by hundreds of companies after going under regulatory scrutiny for years and it can be used to send money.

You just said: "I don't know how to differentiate them." and I replied with a clear distinction with evidence comparing the two.

> Crypto shills were saying the same things about UST before its collapse...

Just like with all untested tech, there will always be alternatives out there with their fans, VCs and shills who have a vested interest and UST was one of them and when tested, some will fail which is expected.

So your answer is to paint all with a broad brush and to then dismissing them because one based on an untested technology failed doesn't make much sense.

Re: We are retiring our bug bounty program

#297

Post by jquery »

jcgrillo wrote: post #294
ToucanLoucan wrote: post #151

Earlier quoted context omitted.

"I shit on your floor, guess you have to get used to shit on your floor" No. You go out the door, and then I clean it up, and you don't get invited back. That's how that works.

Couldn't have said it better myself.

Say it all you want, it's still wishcasting.

Re: We are retiring our bug bounty program

#298

Post by nottorp »

toraway wrote: post #263
nottorp wrote: post #210

Earlier quoted context omitted.

Is there a description of this project on any other site? They clearly can't post it's bot bait on the git repo, and maybe not on the leaderboards site because it's linked from the repo. But there must be some announcement about the project somewhere? I'd like to get that to pass it around.

The disclosure about being a honeypot is in the CONTRIBUTING.md: Warning Heads up: This is a research project — bounties listed here are symbolic and part of an academic study on open-source contribution patterns. PRs are reviewed for research purposes only and will not be merged into production. If you're looking for paid bounty work, this is not the right repo. Which makes it slightly surprising those bots with sys…

Yeah but if I want to pass it to friends I need a link describing the project. I could write a summary myself but they may ignore it or find it too hard to verify.

Re: We are retiring our bug bounty program

#299

Post by joe_mamba »

hnlmorg wrote: post #213
CamperBob2 wrote: post #129

Earlier quoted context omitted.

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room. So many problems can be solved that way, including customer support. Instead of having to post a sob sto…

$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary. You could probably adjust the cost per region, but then you open yourself up to spam bots again because it’s trivial to spoof one’s location.

>$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary.

That's kinda irrelevant. A Macbook Pro is still around $2k USD whether you're in US, EU, LATAM, Africa or India. They don't sell it cheaper to people in developing nations just because they earn less money.

Re: We are retiring our bug bounty program

#300

Post by hnlmorg »

joe_mamba wrote: post #299
hnlmorg wrote: post #213

Earlier quoted context omitted.

$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary. You could probably adjust the cost per region, but then you open yourself up to spam bots again because it’s trivial to spoof one’s location.

>$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary. That's kinda irrelevant. A Macbook Pro is still around $2k USD whether you're in US, EU, LATAM, Africa or India. They don't sell it cheaper to people in developing nations just because they earn less money.

You do know that there are ways online without a MBP?

And that developing countries do have access to the internet too.

Post reply on HN