Live data from Hacker News

$1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

github.com

61–70 of 139 posts

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#61
post #22

I wish there was an actual thriving business model like this -- just fixing most annoying bugs, for a price, of commonly used desktop software. Why proprietary software companies cannot or do not want to provide this service is over me. Perhaps I'm too much used to consulting.

Given that “fixing this issue required weeks of intensive work from multiple people”, the price would have to be prohibitively high. More generally, software is really, really expensive to produce and maintain. The economics only work at scale, in particular for B2C. (Maybe AI will change that, if it becomes more reliable.)

For many large companies or even teams, there exists a class of bugs / issues / features where dropping 5-10k on a bounty is extremely cost efficient compared to working around the issue or internal development. That might not fund development outright, but at worst it would point out the features people want and serve to inform what to work on next. I think there are a couple reasons why that is not prevalent. Most important one is that highly compensated enterprise teams that would benefit the most from placing bounties tend to avoid software that is lacking features or has bugs. Secondary is not implemented here ego and general disconnect between people in the trenches that know what needs to be done and people controlling ability to place bounties.

Imagine FAANG assigning $500 per engineer per year to allocate to feature / bug bounties.

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#62

Earlier quoted context omitted.

> Only frontend React.js Good suggestion, but I discovered that React was not able to fix my Linux kernel, either, for some reason.

Have you tried asking an llm to use react to fix your Linux kernel?

Could an AI agent kidnap Torvalds and force him to do it?

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#63
post #22

Earlier quoted context omitted.

Given that “fixing this issue required weeks of intensive work from multiple people”, the price would have to be prohibitively high. More generally, software is really, really expensive to produce and maintain. The economics only work at scale, in particular for B2C. (Maybe AI will change that, if it becomes more reliable.)

For many large companies or even teams, there exists a class of bugs / issues / features where dropping 5-10k on a bounty is extremely cost efficient compared to working around the issue or internal development. That might not fund development outright, but at worst it would point out the features people want and serve to inform what to work on next. I think there are a couple reasons why that is not prevalent. Most…

Most larger companies would probably find it way easier and more sensible to contract with some outside consultancy to work on these issues than just posting a random bounty, even if the latter might potentially be cheaper. See Google Summer of Code projects for a very practical example of how "just pay randos to work on issue X for cheap" can quite often end up in failure.

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#64

Patching up the kernel to get some sound coming out of the speakers.. Very on brand for Linux.

I agree. I can’t see any reason this couldn’t be packaged as a prebuilt kernel module so end users can trivially install it. The instructions and code here can be used to build the kernel module.

I don’t have this laptop but have built kernel modules in the past to give context. It’s a tiny step to publish this as a kernel module so end users can trivially install this (this reduces the instructions to downloading one file, running one command, with no reboot or rebuild needed) so it’s quite reasonable to call this out and ask someone to do it.

It’s a bit like publishing a windows driver as raw source code. Great work but there’s no reason not to ship the prebuilt driver right?

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#65

Earlier quoted context omitted.

Show us on the doll where they’re wrong.

I'm guessing it's the fact that linux has in-tree drivers, so you necessarily need to "patch the kernel" in order to write/fix a driver for a non-standard compliant device?

I can’t see any blocker to publishing this as a prebuilt kernel module honestly.

For driver developers the above where you rebuild the kernel is a necessary step in developing the driver but now the above is done someone should make the trivial next step to make this into a prebuilt kernel module which are trivial to install for end users with no rebuild/reboot required. (I have built kernel modules before but I don’t have this laptop myself, sorry!).

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#66

Patching up the kernel to get some sound coming out of the speakers.. Very on brand for Linux.

I agree. I can’t see any reason this couldn’t be packaged as a prebuilt kernel module so end users can trivially install it. The instructions and code here can be used to build the kernel module. I don’t have this laptop but have built kernel modules in the past to give context. It’s a tiny step to publish this as a kernel module so end users can trivially install this (this reduces the instructions to downloading on…

Some device classes can be supported in userspace because no matter how an adversarial driver might get the device to misbehave, it cannot possibly break the kernel's security model. This might even apply to some audio devices, depending on how exactly they're hooked up to the rest of your system. But the more typical devices, especially those in your average SoC and those connected to a PCIe bus or the like, have full privileges within the system and will need kernel-level support for the foreseeable future.

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#67
post #55

Earlier quoted context omitted.

and yet, Microsoft Teams is a total trash fire full of bugs that users hate. So something is broken (Teams. It's Teams that is busted).

it's the management structure that's broken. Plenty of decent engineers around microsoft who could fix it, plenty of customer and enterprises willing to pay, but they are not allowed to work on it because of prioritization bullshit, allegedly they could get more money elsewhere That's literally the issue, management by KPI frameworks

I think it has more to do with bundling reducing the need to compete to zero. Change that and the economics of competition would take over and the changes would get prioritized but nobody at Teams needs to sell a single license, so the priorities become the bs like internal status and visibility and not product success.

How many companies have Teams for basically free with their 365 license but still pay for Slack? The marginal value of Teams is nearly zero.

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#68

Earlier quoted context omitted.

I'm guessing it's the fact that linux has in-tree drivers, so you necessarily need to "patch the kernel" in order to write/fix a driver for a non-standard compliant device?

How else is that supposed to work? You either fix a driver in the kernel or a driver outside the kernel, it's not going to make that big of a difference to the person who has to fix it.

[deleted]

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#69

Patching up the kernel to get some sound coming out of the speakers.. Very on brand for Linux.

That's how it works in Linux land for two reasons. One, drivers live in the kernel (roughly). Two, Linux is aftermarket for many hardware, in which cases there's hardware first, then the support.

Re: $1900 Bug Bounty to Fix the Lenovo Legion Pro 7 16IAX10H's Speakers on Linux

#70

Earlier quoted context omitted.

I agree. I can’t see any reason this couldn’t be packaged as a prebuilt kernel module so end users can trivially install it. The instructions and code here can be used to build the kernel module. I don’t have this laptop but have built kernel modules in the past to give context. It’s a tiny step to publish this as a kernel module so end users can trivially install this (this reduces the instructions to downloading on…

Some device classes can be supported in userspace because no matter how an adversarial driver might get the device to misbehave, it cannot possibly break the kernel's security model. This might even apply to some audio devices, depending on how exactly they're hooked up to the rest of your system. But the more typical devices, especially those in your average SoC and those connected to a PCIe bus or the like, have fu…

Kernel modules absolutely run in kernel space though.

I’ve literally written kernel modules for high speed networking devices that have full access to the memory bus and enumerate pci devices. There’s no userspace or kernel space question here. It’s merely a matter of someone turning this into an easily installable kernel module

Post reply on HN