Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

51–60 of 303 posts

Re: We are retiring our bug bounty program

#51

Post by sparklingmango »

satvikpendem wrote: post #32
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

I don't understand why one wouldn't just auto reject big PRs and tell them to make smaller ones. Sounds like it's a communication and social problem, not a technological one. Even with AI, just tell it to make smaller self contained PRs. I do this with Claude or GPT models and they do just fine.

Power dynamics. Usually the person making the giant PRs is the one with all the sway. An earlier-career engineer is unlikely to push back against that level of influence.

Re: We are retiring our bug bounty program

#52

Post by Rover222 »

wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

The reality is somewhere in the middle. Features are shipping 2x to 5x faster at a lot of organizations, with solid code still being produced and reviewed.

Anyone trying to suggest that AI hasn't sped up quality code production is just insisting on keeping their head in the sand, IMO.

Re: We are retiring our bug bounty program

#54

Post by icoder »

JoshTriplett wrote: post #44
mapt wrote: post #13

Earlier quoted context omitted.

How about "It costs $1000 to submit a bug bounty for approval", and raise the reward to $2000 (or $5000 if it's in the cards, since that will have a deterrant impact on non-AI responses). Denominated in BTC to avoid chargebacks etc.

I think that's entirely sensible. Doesn't even have to be that expensive, just expensive enough to deter people who go "oooh, free money", and expensive enough to compensate for having to review slop far enough to realize it's slop.

Wouldn't be surprised if a dollar per entry already made a whole lot of difference.

Re: We are retiring our bug bounty program

#55

Post by jcgrillo »

dale_glass wrote: post #38
ToucanLoucan wrote: post #24

Earlier quoted context omitted.

> I think people would be more interested in listening to "AI skeptics" if they offered realistic solutions to the problems they predict. AI is the fucking problem. Yes, it has (some) uses. It is not nearly the number advertised. And more and more the median use case seems to be, again, overloading people actually trying to do work with an avalanche of bullshit. The solution is exactly what the linked article says: s…

> The solution is exactly what the linked article says: shut it down. At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

> forget about the shutting it down and think of something actually realistic.

Why is it not realistic? Small teams do excellent work. Keep your team small and trusted. Only accept contributions from your team, and people outside your team who are personally vouched for by someone on your team. It's like climbing mountains or sailing or any other type of inherently risky activity--you don't go out with people you don't trust. It's eminently possible, you just don't like the idea of it.

Re: We are retiring our bug bounty program

#56

Post by stronglikedan »

triceratops wrote: post #49
Neywiny wrote: post #20

Earlier quoted context omitted.

I was (almost) just that guy for one PR. Removed something like 20% or more of the codebase by leveraging the libraries and external tools we already had in use better, but it meant almost every single thing we were doing had to use the library function instead of the one we wrote. But assuming you have good regression tests and linters, so you know the code works and it's not terrible, the review should be more abou…

Admirable effort. But why did you have to do it in one PR?

> almost every single thing we were doing had to use the library function instead of the one we wrote

Re: We are retiring our bug bounty program

#57

Post by wslh »

soared wrote: post #34
MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

Moving money is not free, and managing payments/etc can be a huuge headache. Sometimes it’s easy, but sometimes it’s not.

This is one of the cases where crypto works well.

Re: We are retiring our bug bounty program

#59

Post by pscanf »

We sorely need a way to reliably detect AI slop, but unfortunately it doesn't seem possible and it's just getting harder and harder.

Last month I tried my hand at finding a way to tell whether an OSS project is slop or not, based on the amount of "human attention" it received vs the amount of code it contains. The idea is that a 100k LOC project which received 3 days' worth of attention from a human is most certainly slop.

The approach doesn't work very well, though¹, mostly because it's hard to gauge the amount of attention that was given. If I see one commit with +3000 LOC, I can assume it's AI-generated, but maybe you're just the type of dev that commits infrequently.

Maybe we need some sort of "proof of human attention" for digital artifacts, that guarantees that a human spent X time working on it.

¹ I wrote about it here https://pscanf.com/s/352/

Re: We are retiring our bug bounty program

#60

Post by duskdozer »

booleandilemma wrote: post #35
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. So all we have to do is write code without reading or understanding it! Larry Wall was right all along!

Exactly! They should have set [your agentic AI toolkit could be here!] loose on these issues and 100x'd their output, all while actually shipping fixes to these issues instead of closing them. These Luddites are going to be left in the dust as AI is here to stay!
Post reply on HN