2 ms·
Zephyr isn't getting any either that I've seen. The projects in evidence in the article are python and curl, so it's likely limited to only the highest profile
by ajross 2y ago
Zephyr isn't getting any either that I've seen. The projects in evidence in the article are python and curl, so it's likely limited to only the highest profile targets.
What would be interesting is who's doing it and why. The incentives wouldn't seem to be malicious, there's no attempt a-la xz-utils to boost credentials for a real human. Honestly if I had to guess it's an AI research group at Microsoft or wherever trying to tune their coding bots.
- techjamie 2y agoCurl offers a monetary reward as part of their bug bounty program, so that is a contributing factor in their case. It seems to me like talentless hacks looking for ChatGPT to get them easy money/cred without any actual work.
- nfriedly 2y agoYeah, that's probably part of it - none of my projects have any bug bounty.