The end of the #curl bug-bounty

[mae@is.badat.dev]

@bagder not sure if intentional but the article title from pressmind.org had all of it's polish utf-8 characters replaced with "?"

[bagder@mastodon.social]

@Mae argh, I think that's just wordpress being annoying... 😕

[sethmlarson@mastodon.social]

@seanmonstar @bagder Yep... I called for exactly this from platforms: https://sethmlarson.dev/slop-security-reports#what-platforms-can-do

Primarily so that maintainers can collaborate against this sort of behavior, but also to make bad actors known.

[bagder@mastodon.social]

@sethmlarson @seanmonstar I have a meeting with someone at Github in a few hours. I will bring this up!

[nieldk@infosec.exchange]

@bagder a sad, but understandable decision

[tcurdt@mastodon.social]

@bagder without reading the article I knew why 😔

Maybe submitting a repot should cost something? The people that are confident about their findings would get the reward that easily pays for that. For the slop that's just too expensive.

Sounds weird but... maybe?

[bagder@mastodon.social]

@tcurdt so when you read the post you can read my answer to that question!

[tcurdt@mastodon.social]

@bagder

Sorry, I was too quick with my reply 🫣

Yeah, I can see receiving a fee being a pain, too. Especially the uneven barrier to entry feels unfair.

[unlambda@hachyderm.io]

@bagder Makes sense to end the paid program, given the quantity of slop it was receiving. It's too bad because paid bug bounties can be helpful in surfacing real problems, but it makes sense given the circumstances.

Kind of unfortunate to use an AI slop header image along with it, though, don't you think?

[nicolas17@social.treehouse.systems]

@bagder Where's that header image from?