The end of the #curl bug-bounty

[addison@nothing-ever.works]

@bagder@mastodon.social Gotcha, just wanted to ask to make sure since they were listed separately.

[coldclimate@hachyderm.io]

@bagder great write up. Thanks for all you do

[bagder@mastodon.social]

The bugbounty crash of 2025 in a single image (from the blog post)

[ulveon@derg.social]

@bagder@mastodon.social hey Daniel, I'm curious, were you financing the bug bounty payouts by yourself?

[bagder@mastodon.social]

@ulveon no, the IBB did that

[poolitzer@mastodon.social]

@bagder talking about graphs maybe one showing the payout per month/year might be nice?

"The bugbounty cash"

[bagder@mastodon.social]

@poolitzer https://curl.se/dashboard1.html#bug-bounty

[bagder@mastodon.social]

@poolitzer there's also this

[fre@infosec.exchange]

@bagder

Charging people money in an International context is complicated and a maintenance burden.

I think if it does come to this, you might consider requiring a small donation to a charity? This would dramatically reduce the hassle on all sides, and do something good as a bonus.

[bagder@mastodon.social]

@fre receiving money for vulnerability *reports* would not mean that we ship vulnerabilities though...

[fre@infosec.exchange]

@bagder of course not, but I guess someone could spin it like "they now have incentive to publish buggy code", right? Anyway, that wasn't the point of the post and I didn't want to insinuate any bad intentions, sorry. I'll remove that part.

[nini@oldbytes.space]

@bagder Is the header image for the blogpost AI generated?

[bagder@mastodon.social]

@nini to illustrate the point of the blog post, I should probably just say: maybe, maybe not. =)

[ulveon@derg.social]

@bagder@mastodon.social Were you pressured to remove the payouts by them, or was it a decision you requested unilaterally due to slop reports?

[bagder@mastodon.social]

@ulveon I asked them to stop.

[ollej@hachyderm.io]

@bagder I feel that this onslaught of AI slop reports is a DOS attack that weakens the security.

[bagder@mastodon.social]

@ollej that is certainly a risk, yes

[poolitzer@mastodon.social]

@bagder should have looked that up first, ofc you had them ready :D

[nini@oldbytes.space]

@bagder I shall wink in your direction and touch my nose on the side in acceptance of this.

[gsuberland@chaos.social]

@bagder "not even one in twenty was real" is one of the most damning things I've ever heard about the state of BBPs. that's abysmal.