Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

31–40 of 271 posts

Re: cURL removes bug bounties

#31

Post by jraph »

fredrikholm wrote: post #16
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

> An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. I refer to this as the Notion-to-Confluence cost border. When Notion first came out, it was snappy and easy to use. Creating a page being essentially free of effort, you very quickly had thousands of them, mostly useless. Confluence, at least in west EU, is offensively slow. The thought of adding a page is sufficiently demor…

> Consequently, there's some ~20 pages even in large companies.

As someone working on Confluence to XWiki migration tools, I wish this was remotely true, my life would be way easier (and probably more boring :-)).

Re: cURL removes bug bounties

#33

Post by Snakes3727 »

The company I work for has a pretty bad bounty system (basically a security@corp email). We have a demo system and a public API with docs. We get around 100 or more emails a day now. Most of it is slop, scams, or my new favourite AI security companies sending us an AI generated pentest un prompted filled with false positives, untrue things, etc. It has become completely useless so no one looks at it.

I had a sales rep even call me up basically trying to book a 3 hour session to review the AI findings unprompted. When I looked at the nearly 250 page report, and saw a critical IIS bug for Windows server (doesn't exist) existing at a scanned IP address of 5xx.x.x.x (yes an impossible IP) publically available in AWS (we exclusively use gcp) I said some very choice words.

Re: cURL removes bug bounties

#34

Post by bawolff »

ares623 wrote: post #28

Alternate headline: AI discovering so many exploits that cybersecurity can't keep up Am I doing this right?

There is a difference between AI discovering real vulnerabilities (e.g. the ffmpeg situation), and AI being used to spam fake vulnerabilities

Re: cURL removes bug bounties

#35

Post by jameslk »

ValveFan6969 wrote: post #29
jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

"open source" and "business model" in the same sentence... next you're gonna tell me to eat pudding with a fork.

https://en.wikipedia.org/wiki/Business_models_for_open-sourc...

I think you should try eating pudding with a fork next

Re: cURL removes bug bounties

#36

Post by Aeglaecia »

ValveFan6969 wrote: post #29
jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

"open source" and "business model" in the same sentence... next you're gonna tell me to eat pudding with a fork.

i believe that the existence of not for profit organizations is a valid counterpoint to whatever your argument is

Re: cURL removes bug bounties

#37

Post by bawolff »

dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk.

Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was before AI and it was significant work to sort through, i can only imagine what its like now. On the other hand for a submitter, you are essentially working on spec with no garuntee your work is going to be evaluated fairly. Even if it is, you are rolling the dice that your report is not a duplicate of an issue reported 10 years ago that the company just doesn't feel like fixing.

Re: cURL removes bug bounties

#38

Post by arionmiles »

fredrikholm wrote: post #16
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

> An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. I refer to this as the Notion-to-Confluence cost border. When Notion first came out, it was snappy and easy to use. Creating a page being essentially free of effort, you very quickly had thousands of them, mostly useless. Confluence, at least in west EU, is offensively slow. The thought of adding a page is sufficiently demor…

I find this to be a very amusing critique. In my experience, Notion (when I stopped using it 3 years ago) was slow as molasses. Slow to load, slow to update. In comparison, at work, I almost exclusively favor Confluence Cloud. It's very responsive for me.

We have tons of Confluence wikis, updated frequently.

Re: cURL removes bug bounties

#39

Post by bigstrat2003 »

jameslk wrote: post #35
ValveFan6969 wrote: post #29

Earlier quoted context omitted.

"open source" and "business model" in the same sentence... next you're gonna tell me to eat pudding with a fork.

https://en.wikipedia.org/wiki/Business_models_for_open-sourc... I think you should try eating pudding with a fork next

I mean... not what the other poster meant, but https://en.wikipedia.org/wiki/Sticky_toffee_pudding exists and is absolutely delicious.

Re: cURL removes bug bounties

#40

Post by andrewflnr »

johncoltrane wrote: post #26
plastic041 wrote: post #19

Earlier quoted context omitted.

In the second report, Daniel greeted the slopper very kindly and tried to start a conversation with them. But the slopper calls him by the completely wrong name. And this was December 2023. It must have been extremely tiring.

> slopper First new word of 2026. Thank you.

Slop-monger is the term I've seen, and the more evocative one I think.
Post reply on HN