3 ms·

I'm more curious why and how this report got filed. Does curl provide financial incentives for filing CVEs? Or is it a misguided attempt at being helpful? (EDI

I'm more curious why and how this report got filed. Does curl provide financial incentives for filing CVEs? Or is it a misguided attempt at being helpful? (EDIT: from the blog post, there are indeed bug bounties for curl) What do you prompt a LLM with to get a more humanized output and code intermix for a CVE like this, as it doesn't have the typical ChatGPT tropes? There isn't an obvious indicator that it was LLM-generated until it hallucinated a user name and went into the third-person "raised by the triager".

rwmj 3y ago
curl does offer a bug bounty. Unfortunately there's a more fundamental issue: being someone who has filed CVEs can provide some credibility for your resume, that's the financial incentive here, and also the root cause of many many issues with the CVE system.
xcdzvyn 3y ago
> Does curl provide financial incentives for filing CVEs? Up to $10,000 according to their HackerOne page. I could also see this being a misguided attempt at being helpful, given the submitter clearly cannot read C. Though I'm not sure where you'd lie in the computer competency spectrum if you can use an LLM to find code bugs withoug realising they'll probably be hallucinated.
richardwhiuk 3y ago
Yes Curl offers a Bug Bounty - https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/ https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-f...
technion 3y ago
I've seen people file cve requests 20 years ago with the output of "grep strcpy" as the entire report. All an llm bought to this modern version is the apologising, arguing and hallucinated code sample.
- itishappy 3y ago
  Ah, the time wasting bits.
- shadowgovt 3y ago
  It does make one wonder why anyone still uses strcpy in an open source project if it's going to be a perpetual source of having to flag down grep-identified bug reports forever.
  - flohofwoe 3y ago
    The recommended strncpy() is just as bad as strcpy() because you'll end up with a string that's not zero-terminated if the length of the copied string is >= the target buffer size. strlcpy() is a better option but is neither in the C nor POSIX standard. snprintf() is also a good option since C99 but a bit overkill.
    - nneonneo 3y ago
      The submitter’s proposed fix does add null termination, so it does work as expected. Still, strncpy is a horrible API in general. It even has the incredibly stupid behaviour of zeroing out the entire buffer past your string, which is almost never necessary and therefore just a waste of cycles. If zeroing is needed e.g. for security, it’s always better to include an obvious and explicit memset.
- arp242 3y ago
  At least those could be dismissed with almost zero effort. "You clearly didn't spend any effort in your report, so I'm not going to spend a lot of effort replying". But with this it at least looks like they spent the effort, and even though you can suspect LLM chicanery, you can never be entirely sure, especially not from the initial message.

rwmj 3y ago

curl does offer a bug bounty. Unfortunately there's a more fundamental issue: being someone who has filed CVEs can provide some credibility for your resume, that's the financial incentive here, and also the root cause of many many issues with the CVE system.

xcdzvyn 3y ago

> Does curl provide financial incentives for filing CVEs? Up to $10,000 according to their HackerOne page. I could also see this being a misguided attempt at being helpful, given the submitter clearly cannot read C. Though I'm not sure where you'd lie in the computer competency spectrum if you can use an LLM to find code bugs withoug realising they'll probably be hallucinated.

richardwhiuk 3y ago

Yes Curl offers a Bug Bounty - https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/ https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-f...

technion 3y ago

I've seen people file cve requests 20 years ago with the output of "grep strcpy" as the entire report. All an llm bought to this modern version is the apologising, arguing and hallucinated code sample.

itishappy 3y ago
Ah, the time wasting bits.
shadowgovt 3y ago
It does make one wonder why anyone still uses strcpy in an open source project if it's going to be a perpetual source of having to flag down grep-identified bug reports forever.
- flohofwoe 3y ago
  The recommended strncpy() is just as bad as strcpy() because you'll end up with a string that's not zero-terminated if the length of the copied string is >= the target buffer size. strlcpy() is a better option but is neither in the C nor POSIX standard. snprintf() is also a good option since C99 but a bit overkill.
  - nneonneo 3y ago
    The submitter’s proposed fix does add null termination, so it does work as expected. Still, strncpy is a horrible API in general. It even has the incredibly stupid behaviour of zeroing out the entire buffer past your string, which is almost never necessary and therefore just a waste of cycles. If zeroing is needed e.g. for security, it’s always better to include an obvious and explicit memset.
arp242 3y ago
At least those could be dismissed with almost zero effort. "You clearly didn't spend any effort in your report, so I'm not going to spend a lot of effort replying". But with this it at least looks like they spent the effort, and even though you can suspect LLM chicanery, you can never be entirely sure, especially not from the initial message.