4 ms·

I first thought this was a dupe of https://news.ycombinator.com/item?id=37904047 https://news.ycombinator.com/item?id=37904047, but turns out it's a different L

by jsnell 3y ago

I first thought this was a dupe of https://news.ycombinator.com/item?id=37904047 https://news.ycombinator.com/item?id=37904047, but turns out it's a different LLM-generated bogus vulnerability report about curl on hackerone.

ecshafer 3y ago
Great so I am not crazy. I read this and I coulve sworn I had seen this before. This is so similar to the last incident its weird. Are popular projects like Curl just going to have constant LLM written incidents opened against them as people try and get some line items on their resume?
- shadowgovt 3y ago
  Probably. Eventually it might even make sense to accept some of the edits so that the auto-sniffers generating them stop complaining (not unlike making changes to working code that make a linter happy).
- bombcar 3y ago
  Yes. As anyone who has an email associated with a website knows, you'll get random "vulnerability detection spam" requesting bounties. CVE is going to have to up their game.
barryrandall 3y ago
HackerOne's customers are the companies running bug bounty programs. You'd think they'd be a bit more careful about who they allow to spam their customers with clout-seeking LLM garbage.
- nneonneo 3y ago
  First time contributors can have perfectly valid reports, and this particular report was initially written in a reasonably professional style that doesn’t immediately seem out of place (it’s the replies that make it obvious an LLM is being used). Unfortunately, this issue isn’t likely to go away any time soon, and will probably just get worse as the LLMs get used more widely for this type of work. What probably will happen is that maintainers will have to get better at identifying and screening out this kind of nonsense early, and for platforms to get better at banning people who submit bogus reports (but that’s really going to be a whack-a-mole game).
skeptrune 3y ago
damn, I had no idea this had happened before that makes this precedent even more established

by jsnell 3y ago

ecshafer 3y ago

Great so I am not crazy. I read this and I coulve sworn I had seen this before. This is so similar to the last incident its weird. Are popular projects like Curl just going to have constant LLM written incidents opened against them as people try and get some line items on their resume?

shadowgovt 3y ago
Probably. Eventually it might even make sense to accept some of the edits so that the auto-sniffers generating them stop complaining (not unlike making changes to working code that make a linter happy).
bombcar 3y ago
Yes. As anyone who has an email associated with a website knows, you'll get random "vulnerability detection spam" requesting bounties. CVE is going to have to up their game.

barryrandall 3y ago

HackerOne's customers are the companies running bug bounty programs. You'd think they'd be a bit more careful about who they allow to spam their customers with clout-seeking LLM garbage.

nneonneo 3y ago
First time contributors can have perfectly valid reports, and this particular report was initially written in a reasonably professional style that doesn’t immediately seem out of place (it’s the replies that make it obvious an LLM is being used). Unfortunately, this issue isn’t likely to go away any time soon, and will probably just get worse as the LLMs get used more widely for this type of work. What probably will happen is that maintainers will have to get better at identifying and screening out this kind of nonsense early, and for platforms to get better at banning people who submit bogus reports (but that’s really going to be a whack-a-mole game).

skeptrune 3y ago

damn, I had no idea this had happened before that makes this precedent even more established