cURL removes bug bounties

Post by nottorp » Wed, Jan 21, 2026, 7:59 AM UTC

bawolff wrote: post #46

nottorp wrote: post #41

What I wonder is if this will actually reduce the amount of slop. Bounties are a motivation, but there's also promotional purposes. Show that you submitted thousands of security reports to major open source software and you're suddenly a security expert. Remember the little iot thing that got on here because of a security report complaining, among other things, that the linux on it did not use systemd?

I dont think bounties make you an "expert". If you want to be deemed an expert, write blogs detailing how the exploit works. You can do that without a bounty. In many ways one of the biggest benefits of bug bounties is having a dedicated place where you can submit reports and you know the person on the other end wants them and isn't going to threaten to sue you. For the most part, the money in a bug bounty isn't work…

Post by ANarrativeApe » Wed, Jan 21, 2026, 7:59 AM UTC

bawolff wrote: post #37

dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk. Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was bef…

Post by 6510 » Wed, Jan 21, 2026, 8:05 AM UTC

sersi wrote: post #27

saghm wrote: post #23

Earlier quoted context omitted.

That anecdote is hilarious and scary in equal measures. Optional passwords are certainly more convenient than required ones, but so are optional PINs. The most convenient UX would be never needing to log in at all! Unless you find it inconvenient for others to have access to your bank account of course

I really hate the current trend of not having passwords. For example perplexity doesn't have a password, just an email verification to login.

Post by bawolff » Wed, Jan 21, 2026, 8:12 AM UTC

ANarrativeApe wrote: post #53

bawolff wrote: post #37

Earlier quoted context omitted.

Bug bounties often involve a lot of risk for submitters. Often the person reading the report doesn't know that much and misinterprets it. Often rules are unclear about what sort of reports are wanted. A pay to enter would increase that risk. Honestly bug bounties are kind of miserable for both sides. I've worked on the recieving side of bug bounty programs. You wouldnt believe the shit that is submitted. This was bef…

Pay to enter would increase the risk of submitting a bug report. However, if the submission fees were added to the bounty payable, then the risk reward changes in favour of the submitter of genuine bugs. You could even have refund the submission fee in the case of a good faith non bug submission. A little game theory can go a long way in improving the bug bounty system...

Post by shubhamjain » Wed, Jan 21, 2026, 8:13 AM UTC

jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code