Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

cURL removes bug bounties

etn.se

Post reply on HN
Print view View original

91–100 of 271 posts

Re: cURL removes bug bounties

#91

Post by duskdozer »

saghm wrote: post #23
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

That anecdote is hilarious and scary in equal measures. Optional passwords are certainly more convenient than required ones, but so are optional PINs. The most convenient UX would be never needing to log in at all! Unless you find it inconvenient for others to have access to your bank account of course

And the counter where the most secure system never allows anyone to log in ever

Re: cURL removes bug bounties

#92

Post by duskdozer »

dlcarrier wrote: post #85
sersi wrote: post #27

Earlier quoted context omitted.

I really hate the current trend of not having passwords. For example perplexity doesn't have a password, just an email verification to login.

That's what eBay does to me. You get to choose, at the time of login, between entering a password and getting an email verification, or just getting an email verification. At least with the bug report I had submitted to my bank, the password requirement had to be disabled from inside a settings menu, instead of being a clear option in the login prompt, but it that case it wasn't even a 2nd factor.

>You get to choose, at the time of login, between entering a password and getting an email verification, or just getting an email verification.

Ugh, I hate this. I've seen it in other places. Just waiting for them to decide that actually it should be an SMS or a phone call...

Re: cURL removes bug bounties

#93

Post by arjie »

wrxd wrote: post #90
arjie wrote: post #66

It makes sense. This process of searching for bugs was slow and time-consuming so it needed to be incentivized. This is no longer the case. Now the hard part is in identifying which ones are real. To paraphrase a famous quote: AI-equipped bug hunters find 100 out of every 3 serious vulnerabilities.

> Now the hard part is in identifying which ones are real. So it’s still a slow and time consuming process.

Tragically expository, wrxd. My facetiousness condemned through explanation.

Re: cURL removes bug bounties

#94

Post by dlcarrier »

laserbeam wrote: post #73
dlcarrier wrote: post #5

An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick. Then again, I once submitted a bug report to my bank, because the login method could be switched from password+pin to pin only, when not logged in, and they closed it as "works as intended", because they had decided that an optional password was more convenient than a required password. (And that's not even getting into the di…

For weak bank logins, my guess is that reimbursing all account takeovers is cheaper than having a complex login process that would scare away non-technical customers. Or, well, I could see myself making that decision if I were more versed in finance than in computer science and I had a reasonable risk assessment in front of me to tell me how many account takeovers happen.

Banks aren't even liable for losses from account takeovers, at least if their system is compliant, regardless of whether that makes it secure. Their biggest incentive is customer satisfaction, which fraud does hurt.

It's credit cards that have to reimburse for fraud, but they charge the merchant for it, plus fees, so they have absolutely no incentive to prevent fraud, if not an incentive to outright encourage fraud. That would explain why their implementation of the already compromised EMV was further nerfed by a lack of a PIN in the US.

Re: cURL removes bug bounties

#95

Post by duskdozer »

sevenzero wrote: post #69
shubhamjain wrote: post #59

Earlier quoted context omitted.

I feel AI will have the same effect degrading Internet as social media did. This flood of dumb PRs, issues is one symptom of it. Other is AI accelerating the trend which TikTok started—short, shallow, low-effort content. It's a shame since this technology is brilliant. But every tech company has drank the “AI is the future” Kool-aid, which means no one has incentive to seriously push back against the flood of low-eff…

It'll stop soonish. The industry is now financed by debt rather than monetary assets that actually exist. Tons of companies see zero gain from AI as its reported repeatedly here on HN. So all the LLM vendors will eventually have to enshittify their products (most likely through ads, shorter token windows, higher pricing and whatnot). As of now, not a sustainable business model thankfully. The only sad part is that th…

I'm not so confident that "makes the product worse and makes them less money" is even enough to make them not do it anyway

Re: cURL removes bug bounties

#96

Post by em-bee »

Grollicus wrote: post #42
ValveFan6969 wrote: post #29

Earlier quoted context omitted.

"open source" and "business model" in the same sentence... next you're gonna tell me to eat pudding with a fork.

Just leaving this here: https://en.wikipedia.org/wiki/Pudding_mit_Gabel

already decades ago when we were kids eating pudding with a fork was a fun past time, and i am sure the idea is as old as pudding or forks themselves. i mean, the fact that it spread so fast shows that there are many who already practiced it. it's actually surprising it took this long to become a meme.

heck, my cousin bet with me or let me compete eating pudding with chopsticks. (and that was long before i went to china)

practically speaking, the only downside of using a fork (or chopsticks) is scraping the bottom when you are finishing up.

Re: cURL removes bug bounties

#97

Post by charcircuit »

catlifeonmars wrote: post #84
charcircuit wrote: post #75

Earlier quoted context omitted.

>“Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. https://www.gnu.org/philosophy/free-sw.html Being able to learn from the code is a core part of the ideology embedded into the GPL. Not only that, but LLMs learning from code is fair use.

> Being able to learn from the code is a core part of the ideology embedded into the GPL. I have to imagine this ideology was developed with humans in mind. > but LLMs learning from code is fair use If by “fair use” you mean the legal term of art, that question is still very much up in the air. If by “fair use” you mean “I think it is fair” then sure, that’s an opinion you’re entitled to have.

>question is still very much up in the air

It is not up in the air at all. It's completely transformative.

Re: cURL removes bug bounties

#98

Post by jjgreen »

robin_reala wrote: post #62
jameslk wrote: post #35

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Business_models_for_open-sourc... I think you should try eating pudding with a fork next

You’d hardly eat black pudding with a spoon. https://en.wikipedia.org/wiki/Black_pudding

Au contraire: https://www.anotherfoodblogger.com/recipes/potato-leek-black...

Re: cURL removes bug bounties

#99

Post by happosai »

catlifeonmars wrote: post #74
ares623 wrote: post #28

Alternate headline: AI discovering so many exploits that cybersecurity can't keep up Am I doing this right?

Is that the case?

The LLM models give the most likely respond to a prompt. So if you prompt it with "find security bugs from this code" it will respond with "This may be a security bug" than you "you fucking donkey this curl code has already been eyeballed by hundreds of people, you think a statistic model will find something new?"

Re: cURL removes bug bounties

#100

Post by pravj »

jameslk wrote: post #9

It seems open source loses the most from AI. Open source code trained the models, the models are being used to spam open source projects anywhere there's incentive, they can be used to chip away at open source business models by implementing paid features and providing the support, and eventually perhaps AI simply replaces most open source code

Extending on the same line, we will see programs like Google Summer of Code (GSoC) getting a massive revamp, or they will stop operating.

From my failed attempt, I remember that

- Students had to find a project matching their interests/skills and start contributing early.

- We used to talk about staying away from some projects with a low supply of students applying (or lurking in the GitHub/BitBucket issues) because of the complexity required for the projects.

Both of these acted as a creative filter for projects and landed them good students/contributors, but it completely goes away with AI being able to do that at scale.

Post reply on HN