Conversation

Notices

1. Embed this notice
   Lukasz Olejnik (lukaszolejnik@mastodon.social)'s status on Monday, 05-May-2025 18:56:07 JST Lukasz Olejnik

   AI vulnerability/bug founds and reports is a huge problem. Curl has banned the use of AI-generated submissions via HackerOne because none of it made any sense, and is a waste of resources and time. "We are effectively being DDoSed. If we could, we would charge them for this waste of our time" https://hackerone.com/reports/3125832

   • waifu likes this.
   • Embed this notice
     Elias Mårtenson (loke@functional.cafe)'s status on Tuesday, 06-May-2025 01:06:28 JST Elias Mårtenson

     in reply to

     @LukaszOlejnik If I click on the reporter's username, there is a list of "closed bugs" together with dollar amounts. Is this money paid out?

     If so, the slop is profitable, so it won't go away.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 06-May-2025 01:07:42 JST Rich Felker

     in reply to

     • Elias Mårtenson
     • Alun Jones

     @loke @ftp_alun @LukaszOlejnik There should be a cost to have more than a small number of outstanding reports, non refundable if any of them are found to be fraudulent.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Alun Jones (ftp_alun@infosec.exchange)'s status on Tuesday, 06-May-2025 01:07:43 JST Alun Jones

     in reply to

     • Elias Mårtenson

     @loke @LukaszOlejnik You've heard of beg bounty, maybe the next thing is microbegging. As long as it's cheap to submit plausible-sounding bugs, people will do so in the hope that one in a hundred will pay a hundred bucks to make the reporter just quietly piss off.
     I say report them as spam, and block them, if the program has that option.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Elias Mårtenson (loke@functional.cafe)'s status on Tuesday, 06-May-2025 01:07:43 JST Elias Mårtenson

     in reply to

     • Alun Jones

     @ftp_alun @LukaszOlejnik Seems like it. Since it's basically free to send out an uncountable number of reports, there is no limit to the number of reports you can send. On the receiving end, there's a lot of work though, but that's not their problem.