Conversation

Notices

1. Embed this notice
   daniel:// stenberg:// (bagder@mastodon.social)'s status on Wednesday, 04-Feb-2026 22:40:42 JST daniel:// stenberg://

   Early anecdotal data: turning off the bug-bounty may not make much difference... 😱

   • Embed this notice
     Gina Häußge (foosel@chaos.social)'s status on Wednesday, 04-Feb-2026 22:40:39 JST Gina Häußge

     in reply to

     • buherator

     @buherator @bagder I never even had a bug bounty for OctoPrint and yet I get slop (or crap) reports and beg bounty mails. But I used to be forced into huntr.dev, which at it's start handed out money for accepted issues in open source projects, and I slid into the CTO's DMs to get out of there as that definitely increased the amount of crap. So from my experience, not having a bounty program doesn't offer full protection against slop DDOS attacks, but it certainly helps long term.

   • Embed this notice
     daniel:// stenberg:// (bagder@mastodon.social)'s status on Wednesday, 04-Feb-2026 22:40:40 JST daniel:// stenberg://

     in reply to

     • buherator

     @buherator yes, we need to give this time to settle in so this is for sure not a certain observation just yet

     Rich Felker repeated this.
   • Embed this notice
     buherator (buherator@infosec.place)'s status on Wednesday, 04-Feb-2026 22:40:41 JST buherator

     in reply to
     @bagder People probably pay less attention than you think (this is a general rule of thumb of mine), they may still assume there is monetary reward even without H1. IMO you should give it some time.