Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

31–40 of 303 posts

Re: We are retiring our bug bounty program

#31

Post by ToucanLoucan »

xandrius wrote: post #26
ToucanLoucan wrote: post #7

Oh look it's more of exactly what AI skeptics said would happen: low effort bullshit generated at scale making life hell for people actually trying to make things. That's wild. Edit: it is genuinely wild, I don't know of another product category that selects so perfectly for the WORST type of person to be it's enthusiast. Just every single person I see hyped about AI is fucking insufferable on at least one and usuall…

To be fair, you're not making a compelling case for your team either.

[flagged]

Re: We are retiring our bug bounty program

#32

Post by satvikpendem »

wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

I don't understand why one wouldn't just auto reject big PRs and tell them to make smaller ones. Sounds like it's a communication and social problem, not a technological one.

Even with AI, just tell it to make smaller self contained PRs. I do this with Claude or GPT models and they do just fine.

Re: We are retiring our bug bounty program

#34

Post by soared »

MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Moving money is not free, and managing payments/etc can be a huuge headache. Sometimes it’s easy, but sometimes it’s not.

Re: We are retiring our bug bounty program

#35

Post by booleandilemma »

wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code.

So all we have to do is write code without reading or understanding it! Larry Wall was right all along!

Re: We are retiring our bug bounty program

#36

Post by Lalabadie »

xandrius wrote: post #22
MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Easily exploitable without much stretch of a thought. I'd say closing a program which doesn't work anymore is a better idea.

How so? These bot systems work on volume – there's no regard for how much reviewer time they gobble up. The idea is to make producing reports basically free, so getting 1 in 1000 positives is still a success if you have no regard for externalities.

If they have to pay for reviewer time for each of 1000 reports, then the scheme stops being viable.

Re: We are retiring our bug bounty program

#37

Post by user_7832 »

MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Honestly I think this is a great idea. My only suggestion is instead of being very nominal, it should be "reasonable" (so $10 and not $1).

It's even possible to directly link this to maintainers/employees - if you can review 10 such AI/real things per hour (likely more if it's AI slop that's easy to detect), you're generating another revenue stream. Now, I have no idea if these guys are based in SF Bay or a 3rd world country with low COL but as an "add on", $100 an hour isn't too shabby (and can be on the "low end" if one's good at spotting AI crap.)

Side note, isn't it possible to have some way to verify if the "vulns" are actual vulns or not? ...Heck why not throw an LLM at it, powered by a single $10 submission fee?

Re: We are retiring our bug bounty program

#38

Post by dale_glass »

ToucanLoucan wrote: post #24
jquery wrote: post #19

Earlier quoted context omitted.

I think people would be more interested in listening to "AI skeptics" if they offered realistic solutions to the problems they predict. Pandora's box has been opened, let's deal with the consequences now instead of trying to shut the box which cannot be shut.

> I think people would be more interested in listening to "AI skeptics" if they offered realistic solutions to the problems they predict. AI is the fucking problem. Yes, it has (some) uses. It is not nearly the number advertised. And more and more the median use case seems to be, again, overloading people actually trying to do work with an avalanche of bullshit. The solution is exactly what the linked article says: s…

> The solution is exactly what the linked article says: shut it down.

At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

Re: We are retiring our bug bounty program

#39

Post by nukedindia »

ToucanLoucan wrote: post #7

Oh look it's more of exactly what AI skeptics said would happen: low effort bullshit generated at scale making life hell for people actually trying to make things. That's wild. Edit: it is genuinely wild, I don't know of another product category that selects so perfectly for the WORST type of person to be it's enthusiast. Just every single person I see hyped about AI is fucking insufferable on at least one and usuall…

[dead]

Re: We are retiring our bug bounty program

#40

Post by jt2190 »

Neywiny wrote: post #20
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

I was (almost) just that guy for one PR. Removed something like 20% or more of the codebase by leveraging the libraries and external tools we already had in use better, but it meant almost every single thing we were doing had to use the library function instead of the one we wrote. But assuming you have good regression tests and linters, so you know the code works and it's not terrible, the review should be more abou…

You’re not an example of what we’re taking about here. Congratulations!

A better example would be if you’d changed the behavior of the library as you did this work, and the library changes introduced hard-to-detect bugs across the application.

Post reply on HN