The end of the #curl bug-bounty

[bagder@mastodon.social]

@poolitzer https://curl.se/dashboard1.html#bug-bounty

[bagder@mastodon.social]

@poolitzer there's also this

[fre@infosec.exchange]

@bagder

Charging people money in an International context is complicated and a maintenance burden.

I think if it does come to this, you might consider requiring a small donation to a charity? This would dramatically reduce the hassle on all sides, and do something good as a bonus.

[bagder@mastodon.social]

@fre receiving money for vulnerability *reports* would not mean that we ship vulnerabilities though...

[fre@infosec.exchange]

@bagder of course not, but I guess someone could spin it like "they now have incentive to publish buggy code", right? Anyway, that wasn't the point of the post and I didn't want to insinuate any bad intentions, sorry. I'll remove that part.

[nini@oldbytes.space]

@bagder Is the header image for the blogpost AI generated?

[bagder@mastodon.social]

@nini to illustrate the point of the blog post, I should probably just say: maybe, maybe not. =)

[ulveon@derg.social]

@bagder@mastodon.social Were you pressured to remove the payouts by them, or was it a decision you requested unilaterally due to slop reports?

[bagder@mastodon.social]

@ulveon I asked them to stop.

[ollej@hachyderm.io]

@bagder I feel that this onslaught of AI slop reports is a DOS attack that weakens the security.

[bagder@mastodon.social]

@ollej that is certainly a risk, yes

[poolitzer@mastodon.social]

@bagder should have looked that up first, ofc you had them ready :D

[nini@oldbytes.space]

@bagder I shall wink in your direction and touch my nose on the side in acceptance of this.

[gsuberland@chaos.social]

@bagder "not even one in twenty was real" is one of the most damning things I've ever heard about the state of BBPs. that's abysmal.

[joshg@mathstodon.xyz]

@bagder
sorry to hear the slop has ruined a good thing. hopefully HackerOne learn from this and start taking stronger steps to curb this issue.

[kkarhan@infosec.space]

@bagder Granted you got flooded with #AIslop pretty hard...

[seanmonstar@masto.ai]

@bagder yea, GHSA drafts are decent, but I really wish I could disclose a report that has been declined. Github, please?

[mae@is.badat.dev]

@bagder not sure if intentional but the article title from pressmind.org had all of it's polish utf-8 characters replaced with "?"

[bagder@mastodon.social]

@Mae argh, I think that's just wordpress being annoying... 😕

[sethmlarson@mastodon.social]

@seanmonstar @bagder Yep... I called for exactly this from platforms: https://sethmlarson.dev/slop-security-reports#what-platforms-can-do

Primarily so that maintainers can collaborate against this sort of behavior, but also to make bad actors known.