Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

61–70 of 303 posts

Re: We are retiring our bug bounty program

#61

Post by embedding-shape »

jmuguy wrote: post #12

I wonder what Hacktoberfest would look like now if they were still giving out t-shirts to everyone. Probably not enough cotton in the world. It can't be on individual maintainers to stop this, imo its on Github (and Gitlab) to stop these sort of accounts from even getting to the point of submitting PRs. Its essentially spam. Look at the user who created the first PR they reference https://github.com/Samuelsills . Thi…

An account with zero activity doing nothing shouldn't be allowed to continue doing nothing? Did you share the wrong account here maybe?

Re: We are retiring our bug bounty program

#63

Post by dale_glass »

jcgrillo wrote: post #55
dale_glass wrote: post #38

Earlier quoted context omitted.

> The solution is exactly what the linked article says: shut it down. At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

> forget about the shutting it down and think of something actually realistic. Why is it not realistic? Small teams do excellent work. Keep your team small and trusted. Only accept contributions from your team, and people outside your team who are personally vouched for by someone on your team. It's like climbing mountains or sailing or any other type of inherently risky activity--you don't go out with people you don…

That's not shutting anything down, that's just being selective with what you accept, and everyone did that already to some extent.

Even pre-AI it was obvious that contributions have to be vetted for a bunch of reasons.

Re: We are retiring our bug bounty program

#64

Post by tcoff91 »

xienze wrote: post #50
satvikpendem wrote: post #32

Earlier quoted context omitted.

I don't understand why one wouldn't just auto reject big PRs and tell them to make smaller ones. Sounds like it's a communication and social problem, not a technological one. Even with AI, just tell it to make smaller self contained PRs. I do this with Claude or GPT models and they do just fine.

> Even with AI, just tell it to make smaller self contained PRs. Do you want one big PR or 100 small ones? You can't escape the sheer volume of code it's going to produce.

I want a set of smaller ones if it's practical.

Re: We are retiring our bug bounty program

#65

Post by micromacrofoot »

ToucanLoucan wrote: post #7

Oh look it's more of exactly what AI skeptics said would happen: low effort bullshit generated at scale making life hell for people actually trying to make things. That's wild. Edit: it is genuinely wild, I don't know of another product category that selects so perfectly for the WORST type of person to be it's enthusiast. Just every single person I see hyped about AI is fucking insufferable on at least one and usuall…

for every person that's hyping AI there are another 10 just using it to get stuff done without talking about it incessantly

Re: We are retiring our bug bounty program

#67

Post by Neywiny »

triceratops wrote: post #49
Neywiny wrote: post #20

Earlier quoted context omitted.

I was (almost) just that guy for one PR. Removed something like 20% or more of the codebase by leveraging the libraries and external tools we already had in use better, but it meant almost every single thing we were doing had to use the library function instead of the one we wrote. But assuming you have good regression tests and linters, so you know the code works and it's not terrible, the review should be more abou…

Admirable effort. But why did you have to do it in one PR?

As per the other person's comment, yeah basically I could have broken it up but it would've been an arbitrary demarcation. I just deleted our functions and fixed everything that yelled. Admittedly that could've been one and then leveraging the libraries better could've been another, but they would've been 2 PRs that changed almost every line. So done as one to mitigate review time.

Re: We are retiring our bug bounty program

#68

Post by SlinkyOnStairs »

MostlyStable wrote: post #16

Closing the program is totally reasonable. However, there is another option: Make submitters pay a nominal fee that is returned in the case that a real bug is found.

The problem with that approach is that it will also deter genuine submissions, probably moreso than a "no bounty" system.

For those who encounter bugs as part of their employment, they'd now need to convince their employer to fork over money up front. For most employers, getting them to spend even insignificant money is like pulling teeth.

But even for the self-employed or hobbyists, gambling real money on "are they going to be a jerk about my exploit report". No offense towards Turso, but the bulk of software firms are TERRIBLE about handling reports like that. Many already have unstated policies of screwing people out of deserved bug bounties at every step.

To submit such reports today already requires you to accept that your work is statistically, just going to be a bunch of free labour that you gave away for the betterment of the product's users. Adding a cash fee just further deters submissions, especially once people haven't gotten their money back a few times. (Consider how many "AI detection tools" are themselves incredibly unreliable machine learning or sometimes even LLM systems)

Re: We are retiring our bug bounty program

#69

Post by ChrisMarshallNY »

Lalabadie wrote: post #45

Good time to mention this fantastic repo acting as a bot honeypot: https://github.com/UnsafeLabs/Bounty-Hunters The corresponding leaderboard: https://clankers-leaderboard.pages.dev

That's a great project!

It's likely to get blacklisted by AI bots, soon enough, though.

Re: We are retiring our bug bounty program

#70

Post by satvikpendem »

xienze wrote: post #50
satvikpendem wrote: post #32

Earlier quoted context omitted.

I don't understand why one wouldn't just auto reject big PRs and tell them to make smaller ones. Sounds like it's a communication and social problem, not a technological one. Even with AI, just tell it to make smaller self contained PRs. I do this with Claude or GPT models and they do just fine.

> Even with AI, just tell it to make smaller self contained PRs. Do you want one big PR or 100 small ones? You can't escape the sheer volume of code it's going to produce.

100 small ones for sure. There could be a way to auto reject new PRs from an author if they have X open ones unreviewed.
Post reply on HN