5 ms·
Taking for example the one listed as https://hackerone.com/reports/2871792 https://hackerone.com/reports/2871792. With the advantage of hindsight, the issue sh
by Rygian 1y ago
Taking for example the one listed as https://hackerone.com/reports/2871792 https://hackerone.com/reports/2871792.
With the advantage of hindsight, the issue should have been entirely dismissed, and the account reported as invalid, right at the third message (November 30, 2024, 8:58pm UTC); the fact that curl maintainers allowed the "dialog" to continue for six more messages shows to be a mistake and a waste of effort.
I would even encourage curl maintainers to upfront reject any report that fails to mention a line number in the source code, or a specific piece input that triggers an issue.
It's unfortunate that AI is being used to worsen the signal/noise ratio [1] of such sensitive topics such as security.
[1] http://www.meatballwiki.org/wiki/SignalToNoiseRatio http://www.meatballwiki.org/wiki/SignalToNoiseRatio
- zeta0134 1y agoIt's pretty clear that in like half of these the "researcher" is just copy pasting the followup questions back into whatever LLM they used originally. What a colossal waste of everyone's time. I think the only saving grace right this second is that the hallucinations are obvious and text generation is just awkward enough in overly-eager phrasing to recognize. But if you're seeing it for the first time, it can be surprisingly convincing.
- raverbashing 1y agoHonestly? Might be wiser block submissions from certain parts of the world that are known for spamming things like that Or have an infosec captcha, but that's harder to come by
- bluGill 1y agoAs time goes on they are getting faster at closing such reports. However they started off with an assumption of honesty and only after peing burned repeatedly given up. this is bad for the honest person who can't describe a real issue well though.