The end of the #curl bug-bounty

[bagder@mastodon.social]

@fre receiving money for vulnerability *reports* would not mean that we ship vulnerabilities though...

[fre@infosec.exchange]

@bagder of course not, but I guess someone could spin it like "they now have incentive to publish buggy code", right? Anyway, that wasn't the point of the post and I didn't want to insinuate any bad intentions, sorry. I'll remove that part.

[nini@oldbytes.space]

@bagder Is the header image for the blogpost AI generated?

[bagder@mastodon.social]

@nini to illustrate the point of the blog post, I should probably just say: maybe, maybe not. =)

[ulveon@derg.social]

@bagder@mastodon.social Were you pressured to remove the payouts by them, or was it a decision you requested unilaterally due to slop reports?

[bagder@mastodon.social]

@ulveon I asked them to stop.

[ollej@hachyderm.io]

@bagder I feel that this onslaught of AI slop reports is a DOS attack that weakens the security.

[bagder@mastodon.social]

@ollej that is certainly a risk, yes

[poolitzer@mastodon.social]

@bagder should have looked that up first, ofc you had them ready :D

[nini@oldbytes.space]

@bagder I shall wink in your direction and touch my nose on the side in acceptance of this.

[gsuberland@chaos.social]

@bagder "not even one in twenty was real" is one of the most damning things I've ever heard about the state of BBPs. that's abysmal.

[joshg@mathstodon.xyz]

@bagder
sorry to hear the slop has ruined a good thing. hopefully HackerOne learn from this and start taking stronger steps to curb this issue.

[kkarhan@infosec.space]

@bagder Granted you got flooded with #AIslop pretty hard...

[seanmonstar@masto.ai]

@bagder yea, GHSA drafts are decent, but I really wish I could disclose a report that has been declined. Github, please?

[mae@is.badat.dev]

@bagder not sure if intentional but the article title from pressmind.org had all of it's polish utf-8 characters replaced with "?"

[bagder@mastodon.social]

@Mae argh, I think that's just wordpress being annoying... 😕

[sethmlarson@mastodon.social]

@seanmonstar @bagder Yep... I called for exactly this from platforms: https://sethmlarson.dev/slop-security-reports#what-platforms-can-do

Primarily so that maintainers can collaborate against this sort of behavior, but also to make bad actors known.

[bagder@mastodon.social]

@sethmlarson @seanmonstar I have a meeting with someone at Github in a few hours. I will bring this up!

[nieldk@infosec.exchange]

@bagder a sad, but understandable decision

[tcurdt@mastodon.social]

@bagder without reading the article I knew why 😔

Maybe submitting a repot should cost something? The people that are confident about their findings would get the reward that easily pays for that. For the slop that's just too expensive.

Sounds weird but... maybe?