Crazy how he doubled down by just pasting badger's answer into Chat and submitting the (hilariously obvious AI) reply: > Thanks for the quick review. You’re right — my attached PoC does not exercise libcurl and therefore does not demonstrate a cURL bug. I retract the cookie overflow claim and apologize for the noise. Please close this report as invalid. If helpful, I can follow up separately with a minimal C reproduc…
Unfortunately that seems to be the norm now – people literally reduce themselves to a copy-paste mechanism.
For all we know, there's no human in the loop here. Could just be an agent configured with tools to spin up and operate Hacker One accounts in a continuous loop.
There should be a language that uses "Almost-In-Time" compilation. If it runs out of time, it just gives a random answer.
You should send a pull request to DreamBerd/Gulf of Mexico[0], it's surely the only language that can handle it properly! [0] https://github.com/TodePond/GulfOfMexico
Unfortunately that seems to be the norm now – people literally reduce themselves to a copy-paste mechanism.
I watched someone do this during an interview. They were literally copy and pasting back and forth the LLM. In front of the interviewers! (myself and another co-worker) https://news.ycombinator.com/item?id=44985254
I had someone do this in my C# / .NET Core / SQL coding test interview as well, I didn't just end it right there as I wanted to see if they could solve the coding test in the time frame allowed.
They did not, I now state you can search anything online but can't copy and paste from an LLM so as not to waste my time.
Start charging users to submit a vulnerability report. It doesn't matter if it made by AI or a human, spammers operate by cheaply overproducing and externalizing their work onto you to validate their shit. And it works because sometimes they do deliver value by virtue of large numbers. But they are a net negative for society. Their model stops working if they have to pay for the time they wasted.
Even a deposit works well (and doesn't have to be large). Someone who has actually found a serious bug in cURL will probably pay $2-5 dollars as a deposit to report (especially given the high probability of a payout).
I can afford it but I would never spend money to submit a vulnerability report. I'd need to be reporting dozens of vulnerabilities on a single site like hackerone to work up the motivation to plug in payment details and risk having them leaked/stolen in order to do someone else's work for them.
I'd sooner click sponsor for the cURL project on github (something I already do for some OSS I use) than spend money to report a bug.
Unfortunately that seems to be the norm now – people literally reduce themselves to a copy-paste mechanism.
To be honest, I do not understand this new norm. A few months ago I applied to an internal position. I was a NGO IT worker, deployed twice to emergency response operations, knew the policies & operations and had good relations with users and coworkers. The interview went well. I was honest. When asked what my weakness regarding this position I told that I am a good analyst but when it comes to writing new exploits, t…
This is definitely not unique to software engineering. Just out of grad school, 15 years ago, I applied for a position with a local electrical engineering company for an open position. I was passed over and later the person I got a recommendation from let me know, out of band, that they had hired the person because he was fresh out of undergrad with an (unrelated) internship instead of research experience (that I would have been the second out of 3 candidates), but they had fired him within 6 months. They opened the position again and after interviewing again they told me they had decided not to hire anyone. Again, out of band, my contact told me he and his supervisor thought I should go work at one of their subcontractors to get experience, but they didn't send any recommendation and the subcontractors didn't respond to inquiry. I wasn't desperate enough to keep playing that game, and it really soured my view of a local company with an external reputation for engineering excellence, meritorious hiring, mentorship, and career building.
We will quickly evolve a social contract that AI are not allowed to directly contact humans and waste their time with input that was not reviewed by other humans, and any transgression should by swiftly penalized. It's essentially spam, automatically generated content that is profitable in large volume because it offsets the real cost to the victims, by wasting their limited attention span. If you wantme to read your…
I was looking through my work email (my personal email is already too far gone) and realized 90pct of the messages were computer generated. Maybe not AI, but still all automatic process fired messages. I was looking for emails that were deliberately drafted by a human, not even sent only to me. Just messages that a human intentionaly made in the moment. Can't filter them out.
The worst is when your own employer starts spamming your email with useless crap. I would get several emails a day from HR or some other group about some event coming up that I had zero interest in nor asked to be notified of. Don’t forget to sign up for XYZ, check out what your colleagues are saying in Stupid Internal Social Network, and so on.
And worst of all, every “extra-cirricular” group was allowed to abuse the company-wide mailing list to promote their softball games or trivia or whatever else.
Hey don't hate on us humans who genuinely do open random PRs to random projects to fix typos. https://github.com/pulls?q=is%3Apr+author%3Ahenrebotha+archi...
I’d love to know what your genuine motivation is. Is it a desire to genuinely improve projects? Because I’ve always had the impression that people who do this just want to boost their PR counts and GitHub activity numbers.
I once submitted a typo fix, among other things, to XFree86 way back when. Talk about love of the game, good grief.
It's all in aid of some streetsweeper being able to add "contributor to X, Y, Z projects!" to their GitHub résumé. Before LLMs were a thing I also received worthless spelling-incorrection pull requests with the same aim.
Are spelling correction PRs not welcome? I'd never put it on a résumé but if I'm following a README and I see a typo, I'll generally open a quick PR to fix that. (no automated tools, not scanning for typos, just a human reading a README).
A real improvement to the documentation or readme is welcome, even if it is only a minor improvement. I have put in small grammar PRs on some documentation myself.
On the flip side, I used to get a lot of spam PRs that made an arbitrary or net neutral change to our readme, presumably just to get "contributor" credit. That is not welcome or helpful to anyone.
Crazy how he doubled down by just pasting badger's answer into Chat and submitting the (hilariously obvious AI) reply: > Thanks for the quick review. You’re right — my attached PoC does not exercise libcurl and therefore does not demonstrate a cURL bug. I retract the cookie overflow claim and apologize for the noise. Please close this report as invalid. If helpful, I can follow up separately with a minimal C reproduc…
Is it that crazy? He's doing exactly what the AI boosters have told him to do. Like, do LLMs have actual applications? Yes. By virtue of using one, are you by definition a lazy know-nothing? No. Are they seemingly quite purpose-built for lazy know-nothings to help them bullshit through technical roles? Yeah, kinda. In my mind this is this tech working exactly as intended. From the beginning the various companies have…
So basically a hundred billion dollar industry for just spam and fraud. Truly amazing technological progress.