Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

61–70 of 271 posts

Re: cURL removes bug bounties

#61

Post by sudahtigabulan »

dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

> I've since learned that anything heavily regulated like hospitals and banks will have security procedures catering to compliance, not actual security.

Sadly, yeah. And will do anything only if they believe they can actually be caught.

An EU-wide bank I used to be customer of until recently, supported login with Qualified Electronic Signatures, but only if your dongle supports... SHA-1. Mine didn't. It's been deprecated at least a decade ago.

A government-certified identity provider made software that supposedly allowed you to have multiple such electronic signatures plugged in, presenting them in a list, but if one of them happened to be a YubiKey... crash. YubiKey conforms to the same standard as the PIV modules they sold, but the developers made some assumptions beyond the standard. I just wanted their software not to crash while my YubiKey is plugged in. I reported it, and they replied that it's not their problem.

Re: cURL removes bug bounties

#62

Post by robin_reala »

jameslk wrote: post #35
ValveFan6969 wrote: post #29

Earlier quoted context omitted.

"open source" and "business model" in the same sentence... next you're gonna tell me to eat pudding with a fork.

https://en.wikipedia.org/wiki/Business_models_for_open-sourc... I think you should try eating pudding with a fork next

You’d hardly eat black pudding with a spoon. https://en.wikipedia.org/wiki/Black_pudding

Re: cURL removes bug bounties

#63

Post by jameslk »

bigstrat2003 wrote: post #39
jameslk wrote: post #35

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Business_models_for_open-sourc... I think you should try eating pudding with a fork next

I mean... not what the other poster meant, but https://en.wikipedia.org/wiki/Sticky_toffee_pudding exists and is absolutely delicious.

Flan is also a type of pudding (milk/eggs base) which can be ate with a fork. Other baked custards too

Re: cURL removes bug bounties

#64

Post by colechristensen »

GalaxyNova wrote: post #14
novalis78 wrote: post #7

Just use an LLM to weed them out. What’s so hard about that?

Because LLMs are bad at reviewing code for the same reasons they are bad at making it? They get tricked by fancy clean syntax and take long descriptions / comments for granted without considering the greater context.

I don't know, I prompted Opus 4.5 "Tell me the reasons why this report is stupid" on one of the example slop reports and it returned a list of pretty good answers.[1]

Give it a presumption of guilt and tell it to make a list, and an LLM can do a pretty good job of judging crap. You could very easily rig up a system to give this "why is it stupid" report and then grade the reports and only let humans see the ones that get better than a B+.

If you give them the right structure I've found LLMs to be much better at judging things than creating them.

Opus' judgement in the end:

"This is a textbook example of someone running a sanitizer, seeing output, and filing a report without understanding what they found."

1. https://claude.ai/share/8c96f19a-cf9b-4537-b663-b1cb771bfe3f

Re: cURL removes bug bounties

#65

Post by Springtime »

Outside of direct monetary gain like bounties are efforts to just stand out, in terms of being able to show contributions to a large project or getting say a CVE.

Stenberg has actually written about invalid/wildly overrated vulnerabilities that get assigned CVEs on their blog a few times and those were made by humans. I often get the sense some of these aren't just misguided reporters but deliberate attempts to make mountains out of molehills for reputation reasons. Things like this seem harder to account for as an incentive.

Re: cURL removes bug bounties

#66

Post by arjie »

It makes sense. This process of searching for bugs was slow and time-consuming so it needed to be incentivized. This is no longer the case. Now the hard part is in identifying which ones are real.

To paraphrase a famous quote: AI-equipped bug hunters find 100 out of every 3 serious vulnerabilities.

Re: cURL removes bug bounties

#67

Post by sevenzero »

bawolff wrote: post #43
jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

> they can be used to chip away at open source business models by implementing paid features and providing the support There are a lot of things to be sad about AI, but this is not it. Nobody has a right to a business model, especially one that assumes nobody will compete with you. If your business model relies on the rest of the world bring sucky so you can sell some value-added to open-core software, i'm happy when…

Competition is extremely important yes. But not the kind of competition, backed by companies that have much bigger monetary assets, to overwhelm projects based on community effort just to trample it down. The FFMPEG Google stuff as an example.

Re: cURL removes bug bounties

#68

Post by nprateem »

colechristensen wrote: post #64
GalaxyNova wrote: post #14

Earlier quoted context omitted.

Because LLMs are bad at reviewing code for the same reasons they are bad at making it? They get tricked by fancy clean syntax and take long descriptions / comments for granted without considering the greater context.

I don't know, I prompted Opus 4.5 "Tell me the reasons why this report is stupid" on one of the example slop reports and it returned a list of pretty good answers.[1] Give it a presumption of guilt and tell it to make a list, and an LLM can do a pretty good job of judging crap. You could very easily rig up a system to give this "why is it stupid" report and then grade the reports and only let humans see the ones that…

And if you ask why it's accurate it'll spaff out another list of pretty convincing answers.

Re: cURL removes bug bounties

#69

Post by sevenzero »

shubhamjain wrote: post #59
jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

I feel AI will have the same effect degrading Internet as social media did. This flood of dumb PRs, issues is one symptom of it. Other is AI accelerating the trend which TikTok started—short, shallow, low-effort content. It's a shame since this technology is brilliant. But every tech company has drank the “AI is the future” Kool-aid, which means no one has incentive to seriously push back against the flood of low-eff…

It'll stop soonish. The industry is now financed by debt rather than monetary assets that actually exist. Tons of companies see zero gain from AI as its reported repeatedly here on HN. So all the LLM vendors will eventually have to enshittify their products (most likely through ads, shorter token windows, higher pricing and whatnot). As of now, not a sustainable business model thankfully. The only sad part is that this debt will hit the poorest people most.

Re: cURL removes bug bounties

#70

Post by doe88 »

Funny how we are now sensitivized to these AI slops, at first I fixated on the En dashes in the lead of the article, made me doubt of the article's author for a few seconds.
Post reply on HN