Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are retiring our bug bounty program

turso.tech

Post reply on HN
Print view View original

91–100 of 303 posts

Re: We are retiring our bug bounty program

#91

Post by Uvix »

Neywiny wrote: post #67
triceratops wrote: post #49

Earlier quoted context omitted.

Admirable effort. But why did you have to do it in one PR?

As per the other person's comment, yeah basically I could have broken it up but it would've been an arbitrary demarcation. I just deleted our functions and fixed everything that yelled. Admittedly that could've been one and then leveraging the libraries better could've been another, but they would've been 2 PRs that changed almost every line. So done as one to mitigate review time.

Why not leave your functions but have them invoke the libraries instead?

Re: We are retiring our bug bounty program

#92

Post by ChrisRR »

satvikpendem wrote: post #32
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

I don't understand why one wouldn't just auto reject big PRs and tell them to make smaller ones. Sounds like it's a communication and social problem, not a technological one. Even with AI, just tell it to make smaller self contained PRs. I do this with Claude or GPT models and they do just fine.

Because sometimes in order to add or change a feature, huge changes need to be made all at once

Re: We are retiring our bug bounty program

#94

Post by esafak »

Rover222 wrote: post #52
wg0 wrote: post #8

Which goes on to prove that bottleneck isn't in writing the code. It is in reading and understanding the code. We all had that one "productive" engineer in our teams who would write huge PRs that would have large swaths of refactoring whether warranted or not and that was way before anyone even could imagine in their wildest dreams that neural networks could generate that huge amounts of code. The net effect of such…

The reality is somewhere in the middle. Features are shipping 2x to 5x faster at a lot of organizations, with solid code still being produced and reviewed. Anyone trying to suggest that AI hasn't sped up quality code production is just insisting on keeping their head in the sand, IMO.

They're just working at companies with mature products where people are in meetings all day -- they say so! Startups very much want to crank shit out faster.

Re: We are retiring our bug bounty program

#95

Post by mort96 »

rvz wrote: post #80
wslh wrote: post #57

Earlier quoted context omitted.

This is one of the cases where crypto works well.

There are many cryptocurrencies that allow anyone to move money quickly, cheaply, and on the same day in less than a minute and requires zero bank accounts. At this point there isn't an excuse.

And which are trivial to convert back and forth between real money and cryptocurrency? And hold their value with sufficient stability that you can convert USD into the currency, make a transaction, wait a few weeks, make a transaction the other direction and then convert back into USD, with roughly no loss in value?

Re: We are retiring our bug bounty program

#96

Post by triceratops »

stronglikedan wrote: post #56
triceratops wrote: post #49

Earlier quoted context omitted.

Admirable effort. But why did you have to do it in one PR?

> almost every single thing we were doing had to use the library function instead of the one we wrote

Why not proceed file-by-file or directory by directory?

Re: We are retiring our bug bounty program

#97

Post by dogleash »

CharlesW wrote: post #78
limaoscarjuliet wrote: post #27

Earlier quoted context omitted.

"[...] bottleneck isn't in writing the code. It is in reading and understanding the code". 100% agreed! Furthermore, the more code is generated by AI, the fewer people will actually understand it!

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

To the extent that's true, it's already a problem plaguing the profession.

I wouldn't advocate for using different tools, but everyone should be able to reason about the machine instructions underlying their code. Both in the immediate sense of the assembly a simple function turns into, and the tricks language runtimes use to enable their neat features.

The attitude that things are magic is poison. There is a difference between feeling confident something is comprehensible and not yet needing to go learn it, vs resigning to a position of powerlessness.

Re: We are retiring our bug bounty program

#98

Post by caymanjim »

pscanf wrote: post #59

We sorely need a way to reliably detect AI slop, but unfortunately it doesn't seem possible and it's just getting harder and harder. Last month I tried my hand at finding a way to tell whether an OSS project is slop or not, based on the amount of "human attention" it received vs the amount of code it contains. The idea is that a 100k LOC project which received 3 days' worth of attention from a human is most certainly…

There's no reason to care that a human spent time on it.

Humans are bad at writing code. Garbage PRs and slop have been a problem in open source and bug bounty programs since long before AI came on the scene.

We need better AI so that there's no need to solicit external bug fixes, and better AI so other contributions can be evaluated for usefulness and quality.

What do you care if a human ever looked at it at all? It implies that humans are adding value to the process. It's possible for a human to add value. The right human can add tremendous value. But I'll take a completely autonomous AI over 99% of the human software engineers and 99% of the people contributing PRs and bugfixes.

It was hard to keep up with slop before. It's a lot harder now. AI will help weed through the garbage.

Re: We are retiring our bug bounty program

#99

Post by discreteevent »

CharlesW wrote: post #78
limaoscarjuliet wrote: post #27

Earlier quoted context omitted.

"[...] bottleneck isn't in writing the code. It is in reading and understanding the code". 100% agreed! Furthermore, the more code is generated by AI, the fewer people will actually understand it!

Generally, software engineers already have little to no understanding of the code that's actually being executed. We're so used to high- and higher-level abstractions like C, Go, Python, and JavaScript that we forget that we're already working with mostly-deterministic symbolism in a process that more closely resembles invoking magic spells than writing machine code. One more level of abstraction is not the end of so…

This argument comes up a lot. The point is that with unreviewed AI nobody understood the code at any time (including the AI). This is completely different to a C compiler wherein the writers and maintainers deeply understand the code. This means that even though I don't understand it, I can use it with some confidence.

Your point about AI being another abstraction similar to the "mostly deterministic" C compiler also comes up often but there are many arguments against it. If you think the determinism of a compiler and an AI are similar then I'm not sure whether you know anything about how either of them work or have even compared examples of what they produce.

Re: We are retiring our bug bounty program

#100

Post by dale_glass »

miyoji wrote: post #75
dale_glass wrote: post #38

Earlier quoted context omitted.

> The solution is exactly what the linked article says: shut it down. At this point it's impossible, so I concur with the parent: forget about the shutting it down and think of something actually realistic.

This response is incredibly annoying and insufferable. It's only "impossible" at this point because people continually ignored skeptics and anyone warning about exactly these outcomes. Now that doom is here, it's too late to do anything about it. Just accept the doom!

The critics didn't do themselves any favors. Part think the Terminator has something useful to say on the subject, part invent contrived scenarios like self-driving cars having to resolve trolley problems. Reality turned out to be much more boring.

But yes, what you said but unironically. Like it or not it's here, it's not going away, so all the remaining options have to assume that.

Post reply on HN