14 ms·
We will ban you and ridicule you in public if you waste our time on crap reports
- treadump 10mo ago[flagged]
- fp64 10mo agoWhy bring politics into this discussion? Edit: that person (or bot) has almost exclusively posted on this website about the current US president. I think it's a waste engaging and I already regret my comment here
- keyle 10mo agoThis is clearly a bot or a troll.
- ramon156 10mo agoCan you elaborate? What does trump have to do with allowing early denial of bad ORs
- jahsome 10mo agoReading between the lines a bit, but I think the point is that public ridicule and personal attacks as well a general lack professionalism is a page out of his book. So I think OP is trying to insinuate POTUS' behavior inspires a general lack of decorum, a la trickle-down dickonomics. Which is a sentiment I can't in good faith disagree with entirely, but it seems like a stretch in this case.
- cmonfriend 10mo agois public ridiculing of somebody who intentionally submits garbage in order to potentially earn a few bucks a bad thing? it's like with patent trolls, dragging their shady actions to public and ridiculing them is best thing that can happen
- jahsome 10mo agoI get your point, but regardless of how justified it may seem, I find behaving that way just isn't nearly as effective as kindness. When I'm not being conscious, I tend to be pretty negative or sarcastic and even trend towards passive aggressive. I've found it to be rather damaging for a number of reasons. I find when I choose kindness, not only is it more effective at accomplishing my goals, but I am happier and I set a better example for those around me. I find the kinder I respond ESPECIALLY in situations where it feels undeserved, the more positive impact it has. To put it in more cliche terms, I want the world to be a kinder place, and I am trying to be the change I seek. So yeah, personally I think it's a bad thing. Ban em, sure. But why take it any further? And FWIW, I'm sure the "threat" of ridicule is more tongue in cheek than anything, I was just trying to elaborate on what I suspected the other commenter was intimating.
- bennett_dev 10mo agoNothing to do with politics and everything to do with crappy AI slop. There was some list somewhere of some of those reports and it was painful to look at
- cmonfriend 10mo agowhy are you linking this to politics? I have to deal with crap "security disclosures" every week. those, so called security experts, report security vulnerabilities for features I don't even have! They should be ridiculed in public!
- iszomer 10mo agoNot Trump specifically but the various prevalent trends of online "cancel culture" experienced for the past decade or longer.
- jraph 10mo agoContext: [1, 2] > Open source code library cURL is removing the possibility to earn money by reporting bugs, hoping that this will reduce the volume of AI slop reports. > cURL has been flooded with AI-generated error reports. Now one of the incentives to create them will go away. [1] https://news.ycombinator.com/item?id=46701733 https://news.ycombinator.com/item?id=46701733 [2] https://etn.se/index.php/nyheter/72808-curl-removes-bug-bounties.html https://etn.se/index.php/nyheter/72808-curl-removes-bug-boun...
- dotancohen 10mo agoMoney for a report and a patch, with convincing test cases, might be worthwhile. Even if a machine generates them.
- hobs 10mo agoTo be clear, no, it is not, because of the opportunity cost of all the other slop. That's what this is all about.
- johnisgood 10mo agoThen no bug reports and no fixes. Sounds good enough.
- mikkupikku 10mo agoThey'll still get bug reports and fixes from people who actually give a shit and aren't just trying to get some quick money.
- latexr 10mo agoOf course there are still bug reports and fixes without financial compensation. The proof is all of open-source, including cURL.
- creata 10mo ago> Even if a machine generates them. That sounds wonderfully meritocratic, but in the real world, a machine generating it is a very strong signal that it's bullshit, and the people are flooding maintainers using the machines. Maintainers don't have infinite time.
- mgaunard 10mo agoThe new era of AI.
- dotancohen 10mo agoEverybody saw it coming. Frankly I'm surprised it took this long.
- pepperball 10mo agoNot everybody. Some very mentally ill individuals thought we’d all be living in some start-trek post scarcity TV show.
- burnt-resistor 10mo ago"It is difficult to get a man to understand something, when his salary depends on his not understanding it." - Upton Sinclair It's kind of like people who live at the base of a giant dam but cannot comprehend that it could ever fail.
- diffuse_l 10mo agoThe policy link[0] page still has a link to the bug bounty program[1] which still discuss monetary compensation. [0] https://curl.se/dev/vuln-disclosure.html https://curl.se/dev/vuln-disclosure.html [1] https://curl.se/docs/bugbounty.html https://curl.se/docs/bugbounty.html
- mrspuratic 10mo agoAlthough it's not mentioned in those, it's going away at the end of the month: https://news.ycombinator.com/item?id=46701733 https://news.ycombinator.com/item?id=46701733 https://news.ycombinator.com/item?id=46678710 https://news.ycombinator.com/item?id=46678710
- nchmy 10mo agoI've been helping a bit with OWASP documentation lately and there's been a surge of Indian students eagerly opening nonsensical issues and PRs and all of the communication and code is clearly 100% LLMs. They'll even talk back and forth with each other. It's a huge headache for the maintainers. I suggested following what Ghostty does where everything starts as discussions - only maintainers create issues, and PRs can only come from issues. It seems like this would deter these sorts of lazy efforts.
- mikkupikku 10mo agoHeh, reminds me of that free T-shirt contest thing... Submit crap PRs to random FOSS projects for a chance of winning a shirt, what could go wrong? https://ongchinhwee.me/shitoberfest-ruin-hacktoberfest/ https://ongchinhwee.me/shitoberfest-ruin-hacktoberfest/
- yawboakye 10mo agoworked well for a bit. but then the program became popular and that’s when it hit the curb. terrible loss, imo. it was a brilliant idea to encourage open source work with a token reward. it relied heavily on good intentions, which quickly disappeared with the popularity.
- wink 10mo agoI have one of these and it was really nice in the first 1-n years. People gamified it and then it sucked, but the idea wasn't so bad. One would expect people would not stoop this low for a free T-Shirt.
- ryandrake 10mo agoThere is no limit to how low someone will stoop to get even a tiny token for free. I remember a local community fun event from a couple of years ago, which was set up by the library to encourage kids to read. They would count up these reading tokens at the end of it and give some tiny $2 teddy bear to the winners, and of course a bunch of adults swooped in, gamed the system, and all the toys went to them. People are totally shameless assholes when even an insignificant free prize is on the line.
- defraudbah 10mo agolol, fair and square
- bilekas 10mo agoThis is great actually. I can feel the sentiment of the slop they've had to deal with. Fair play to them.
- rednafi 10mo agoCreating crap vuln reports or PRs on popular OSS projects has been an issue long before LLMs. Remember Hacktoberfest? Students would often abuse it since there’s no adult in the room to teach them how to behave. I guess this is one hard way to f around and find out. But this is by no means condoning this sort of behavior. Point is, LLMs made the situation more dire: it’s cheap to generate code, whereas reviewing still scales sublinearly. The only way to prevent this is by being rude to people who are rude to you.
- ffaser5gxlsll 10mo agoIt's never fine to be rude. Moving off github into a more niche platform was the best choice I have ever made to curb such zero-effort issue and feature requests. It raises the barrier just enough. On the other hand, I'm a dev, and I hate the "start a discussion first" gatekeeping. I participated in projects where the approach is to start a discussion on a forum first, and I get the same feeling you have as a tech guy calling ISP support on the phone.
- eXpl0it3r 10mo agoThe discussion requirement is often to prevent disappointment, waste of time, and anger, when maintainers simple close PRs, because it's not the direction they want the project to go. A lot of people will take this very personally, so it's much better to have a conversation about it beforehand.
- Capricorn2481 10mo ago> On the other hand, I'm a dev, and I hate the "start a discussion first" gatekeeping Seems like a completely appropriate way to handle things if you're still on Github. You said yourself the spam drove you off. They could let people who are proven not to be spammers open PRs directly.
- ffaser5gxlsll 10mo ago> You said yourself the spam drove you off. Yes, indeed. But I still stand by the gatekeeping though. Sadly, it's a tragedy due to how popular github (and similar services) have become. These sites were supposed to be by developers for developers.
- thephyber 10mo agoI am friends with a solo maintainer of a major open source project. He repeatedly complains that at the beginning of some semester, he sees a huge spike of false/unproveable security weakness reports / GutHub issues in the project. He thinks that there is a Chinese university which encourages their students to find and report software vulns as part of their coursework. They don’t seem to verify what they describe is an actual security vuln or that the issue exists in his GitHub repo. He is very diligent and patient and tries to verify the issue is not reproducible, but this costs him valuable time and very scarce attention. He also struggles because the upstream branch has diverged from what the major Linux distribution systems have forked/pulled. Sometimes the security vulns are the Linux distro package default configurations of his app, not the upstream default configurations. And also, I’m part of the Kryptos K4 SubReddit. In the past ~6 months, the majority of posts saying “I SOLVED IT!!!1!” Are LLM copypasta (using LLM to try to solve it soup-to-nuts, not to do research, ideate, etc). It got so bad that the SubReddit will ban users on first LLM slop post. I worry that the fears teachers had of students using AI to submit homework has bled over into all aspects of work.
- salawat 10mo ago>I worry that the fears teachers had of students using AI to submit homework has bled over into all aspects of work. As one does in academia, so to the market, because now we have financial incentive. It ain't going to stop.
- throwaway85825 10mo agoIn china medical students are required to publish original papers. Instead they just pay someone to write it for them and pollute the literature.
- 0dayman 10mo agothey're suffering from this big time: https://www.youtube.com/watch?v=6n2eDcRjSsk&t=2453s https://www.youtube.com/watch?v=6n2eDcRjSsk&t=2453s
- embedding-shape 10mo agoAh, brings back memories when TPB did something similar to when MPAA and their "associates" emailed them. I think this is probably the best page where one could still see them: https://web.archive.org/web/20111223101839/http://thepiratebay.org/legal https://web.archive.org/web/20111223101839/http://thepirateb... I'm not sure it helped in the end, afaik they did it since like 2003 until some years after the raid, but it still seemed like they didn't get the message and kept trying anyways, which from their perspective makes sense but still.
- hypeatei 10mo ago> We will ban you and ridicule you in public if you waste our time on crap If shame worked, then slop reports would've stopped being made already. Public ridicule only creates a toxic environment where good faith actors are caught up in unnecessary drama because a maintainer felt their time was being wasted. Ban them, close your bug bounty program, whatever, but don't start attacking people when you feel slighted because that never ends well for anyone (including curl maintainers)
- maipen 10mo agoThis is 100% true. I've seen this happen over and over again. Shaming does not work, you look like an idiot, people will start to despise you and then you end up ostracizing yourself from the rest of the community and the only ones left within your bubble, are circle jerk assholes. It's one of those cases where you end up causing more harm than the ones you were complaining about. Just pathetic behaviour.
- f311a 10mo agoIt worked well for me when people were stealing my articles, pretending they wrote them. One tweet or mention in Linkedin and the article is gone.
- hypeatei 10mo agoPlagiarism is much different than collaborating on open source projects but I'm glad that calling them out worked.
- pharrington 10mo agoTest your hypothesis by attaching your offline name to your internet profiles.
- hypeatei 10mo agoThat's sort of the whole point of this thought exercise, no? If shame worked in an environment with anonymous/pseudonymous users, then we wouldn't be here. The only people you stand to harm are the ones who attach their real identities to their profile (and they're more likely to be good faith IMO) Besides, I've seen plenty of profiles here on HN who advertise their real name and espouse (in my view) awful takes that would most likely not fly in real life. I'd recommend reading this article[0] for an example of when people, with their real names exposed, can still cause a shitstorm of misunderstanding. 0: https://lwn.net/Articles/973782/ https://lwn.net/Articles/973782/
- Applejinx 10mo agoOne way this can backfire: if you have no reputation and are nobody, and get banned and publically ridiculed, this is now a badge of honor you can take to wealthy and deluded people convinced of the AI future, to say 'look, I have been shot at! I'm a true believer!' And then maybe they will give you money.
- direwolf20 10mo agoOnly if there's a wealthy political group that hates the thing you just got ridiculed by. When you get expelled from a climate conference you can become a right-wing figurehead, but when you get expelled from the cURL vulnerability program, nobody cares.
- sschueller 10mo agoI like the idea of refundable submission fee for bug bounties. No refunds for slop and poorly researched submissions.
- amiga386 10mo agoLinks to all those crap reports: https://gist.github.com/bagder/07f7581f6e3d78ef37dfbfc81fd1d1cd https://gist.github.com/bagder/07f7581f6e3d78ef37dfbfc81fd1d... (from https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/ https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...)
- wojciii 10mo agoFrom https://curl.se/docs/code-of-conduct.html https://curl.se/docs/code-of-conduct.html: "As contributors and maintainers of this project, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities" Why have a code of conduct while being hostile to contributors? I think they should handle this differently.
- deleted 10mo ago[deleted]
- defraudbah 10mo agoall curl team came here to downvote you, don't be so cruel :D
- javcasas 10mo agoI don't think that telling a LLM to create a fake bug report is "contributing".
- deleted 10mo ago[deleted]
- 8organicbits 10mo agoThere's no mention of LLMs in the link. Humans are perfectly able to generate "crap reports" on their own. I think the parent is correct in calling out the inconsistency of promoting personal attacks when that is explicitly forbidden in the CoC.
- michaelbuckbee 10mo agoI think this is probably less effective than if there was some sort of "credit" or reputational score for reporting that seems like something GitHub would have the information to implement.
- IshKebab 10mo agoYeah this seems like a good idea. Plenty of games have "you have to have this much reputation to play in ranked games" sort of things. I guess people would complain if it was tied to Github.
- tonyedgecombe 10mo agoI’d hate to see GitHub assigning reputation to users.
- latexr 10mo ago> seems like something GitHub would have the information to implement. But not the motivation. GitHub incentives this type of behaviour, they push you to use their LLMs. GitHub is under Microsoft’s AI division. https://www.geekwire.com/2025/github-will-join-microsofts-coreai-group-with-departure-of-ceo-thomas-dohmke/ https://www.geekwire.com/2025/github-will-join-microsofts-co...
- embedding-shape 10mo ago> GitHub is under Microsoft’s AI division. Finally an explanation to why GitHub suddenly have way more bugs than usual for the last months (year even?), and seemingly whole UX flows that no longer work. I don't understand how it happens, do developers not at least load the pages their changes presumable affects? Or is the developers doing 100% vibe-coding for production code? Don't get me wrong, I use LLMs for development too, but not so I can sacrifice quality, that wouldn't make much sense.
- tomaskafka 10mo agoI just listened to podcast from a higher echelon MSFT person, the internal orders basically are “focus on AI”, non-AI work gets deprioritized company wide.
- deleted 10mo ago[deleted]
- yrro 10mo agoSomehow, I knew this would be curl before finishing reading the headline. Good on them!
- latexr 10mo agoI was going to add “cURL: “ at the start of the title, but it didn’t fit. The current title is exactly the allowed length, so it seemed more appropriate to keep the message verbatim.
- hahahahhaah 10mo agoDog whistle to AI. Love it.
- trgn 10mo agoAI doesn't mind you'll be ridiculing it in public
- hahahahhaah 10mo agoNot yet
- trgn 9mo agogood point!
- julius-fx 10mo agoFair enough.
- zkmon 10mo agoThere's going to be avalanches of code everywhere. You can no longer expect some human to know what some code does or maintain it.
- hypeatei 10mo agoWhich is exactly what the AI companies want. An unmaintainable mountain of code that you need their cloud-based, paywalled LLMs to handle for you.
- zkmon 10mo agoYep. Vendor-locking, AI-locking and also human-locking. The last one is where the code can only be maintained by specific persons.
- Lapsa 10mo ago[flagged]
- jen20 10mo agoYou certainly can expect “some” human to know what “some” code does. Things you cannot expect: - ALL humans to know what SOME code does - SOME humans to know what ALL code does.
- ironbound 10mo agoCan anyone tell me in 2025 how much big tech made in revenue from AI..
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- robin_reala 10mo agoRevenue or profit?
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- j-bos 10mo agoSeems like a lot of the problems had by the low friction of first eternal september and now LLM genrated reports and contributions, could be resolved by restoring friction. First time reporters/contributers could be required to send their report or PR by paper mail. Strict requirements for the sender: all text printed on postcards (no letter opening) as QR or other data codes according to a standard formatting. Anything even slightly off goes straight to the trash, high signal/interest contributors can still get their foot in the door.
- SloppyDrive 10mo agoThe eternal-september; or its international equivalent, kills things because the nature of the public you are interacting with has changed. These issues with reports and junk contributions come about because there is a huge payoff for pretending to be part of the community, but the benefit from actually contributing is generally less direct. I dont think you can solve this with "friction", because the people you want to dissuade are more tolerant to these kinds of barriers than the ones you want invite in.
- deleted 10mo ago[deleted]
- CrzyLngPwd 10mo agoEvery site and every service is going to be swamped with AI-generated slop and will have to deal with it by banning it, and then detecting and deleting it. This was entirely predictable. When you give everyone the ability to be good at something with no effort, everyone is going to do it (and think they are the first). My partner recently bought a book from Amazon, and when it arrived, I looked at the cover, flicked through it, and said it was AI slop. She complained to Amazon, and they just refunded her, no questions asked, and the book went in the fire.
- latexr 10mo ago> When you give everyone the ability to be good at something with no effort When you give them the ability to think they’re good. If they truly became good, this wouldn’t be an issue.
- vivzkestrel 10mo ago- I notice a lot of stuff in github issues all the time - For example, there is this +1 comment pasted like 500 times that I have seen a lot over issues - Cant we have a github regex bot of sorts ^(\W+)?\+(\W+)?1(\W+)?$ that removes all such comments? or let the author of the repo control what kind of regex based stuff to remove? - I know regex kind of sounds old fashioned in the age of LLMs but it is kinda simple to manage and doesnt require crazy infra to run
- direwolf20 10mo agoYes you can, and those comments will then say "plus one", which you will add to your regex, and then they will say "++", which you will add to your regex, and then they will say "I agree", which you will add to your regex, and then they will say "me too", ......
- LeoNatan25 9mo ago+9001 agree, this arms race is doomed.
- mixedbit 10mo agoLong time ago Sourceforge and then GitHub promoted into the current default the model of open source distribution which is not sustainable and I doubt it is something that the founding fathers of Free Software/Open Source had in mind. Open source licenses are about freedom of using and modifying software. The movement grew out of frustration that commercial software cannot be freely improved and fixed by the user to better fit the user's needs. To create Free software, you ship sources together with your binaries and one of the OSI-approved licenses, that is all. The currently default model of having an open issue tracker, accepting third party pull requests, doing code reviews, providing support by email or chat, timely security patches etc, has nothing to do with open source and is not sustainable. This is OK if it is done for a hobby project as long as the author is having fun doing this work, but as soon as the software is used for commercial, production critical systems, the default expectation that authors will be promptly responding to new GitHub issues, bug reports and provide patches for free is insane. This is software support, it is a job, it should be paid.
- spicyusername 10mo agohas nothing to do with open source long time ago Sourceforge is almost 30 years old. GitHub almost 20. How long does something have to be done a certain way for it to be "to do with"? I would say we're now two generations deep of software engineers who came up with open source software commonly being mediated through public issue trackers. That isn't to say it needs to stay that way, just that I think a lot of people do in fact associate public project tracking with open source software.
- 10mo ago
- vitrealis 10mo agoWhy is cURL specifically receiving so many slop contributions? Or is this a recent phenomenon for every open-source project, and cURL are the ones most spoken of? First time commenting on HN!
- dirkt 10mo agoThey offered a bug bounty, so people think "let me just use ChatGPT to make money for myself". But from I hear it affects other projects too. It affected curl more because with the bug bounty they actually need to invest work and look at those. [1] https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/ https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-f... [2] https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/ https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...
- hypfer 10mo agocUrl as a project has a lot of conceptual attack surface for someone looking to find _anything_. It is large, very popular (hence impact) and written in C. It supports many many many protocols with all of their real-world implementation quirks. Obscure or mainstream. And always handling user-controlled data. If your motivation is a cool CVE for your CV, you'd pick such a project as the target of your efforts.
- acdha 10mo agoIt’s not just them, but curl is one of the most popular open source projects in existence and it’s used in areas where security is a significant concern. The security industry has a lot of emphasis on someone’s portfolio for hiring, which isn’t bad (it beats “what frat were you in?”) but it means that there are a ton of early career people thinking that the path to a better job is getting credited for CVEs on major projects. That’s a bad combination with LLMs which are almost perfect for letting the user think they’re being more productive than they actually are because the output sounds authoritative. You don’t have to be acting in bad faith to submit a slop report, just being inexperienced and over-confident will work if you don’t have enough experience in the area to reason about the security of the entire system.
- Galanwe 10mo agoHaving an overly long captcha for bug bounties / reports may be the one place where it serves a purpose
- bob1029 10mo agoThis note isn't going to stop even 1% of the jackasses who would have submitted AI slop. There are much better ways to communicate the intended message. This comes off as childish to me and makes me think that I'd rather not contribute to the project.
- cmxch 10mo agoWouldn’t be surprised if there’s a fork of curl that addresses it.
- GaryBluto 10mo ago> This comes off as childish to me and makes me think that I'd rather not contribute to the project. It's unfortunately the new normal, with FFmpeg's core team acting similarly. No doubt the result of what is considered socially acceptable expanding in ways it probably shouldn't.
- redeeman 10mo agothat is a view many hold, until its their own time being wasted. Consider the responsibility these people have and take on their shoulders, only for a bunch of idiots to consider their AI slop worthy of pissing up and down their face. Most of them probably even know its just AI slop spraying spree
- GaryBluto 10mo agoMany people deal with worse every day and don't resort to acting like a child.
- dmezzetti 10mo agoIt's been an issue for a while and it's even bigger now in the age of AI. Lots of people use security as a way to "have their moment" and don't really care about adding value. But scaring people off from security reports also isn't a great idea either.
- anArbitraryOne 10mo agoNice. But it deters people like me who aren't totally confident in sending reports, trading false positives for false negatives
- bilekas 10mo ago> it deters people like me who aren't totally confident in sending reports This is by design, you shouldn't be submitting reports on anything less than certainty. It's not the maintainers responsibility to prove out your idea. It's yours, and when you're sure, reproduceable, and documented it, then you can submit it.
- tehryanx 10mo agoThe real problem here is that this is now the only way the maintainer/reporter can reasonably work. Proving out a security vulnerability from beginning to end is often very difficult for someone who isn't a domain expert or hasn't seen the code. Many times I've been reasonably confident that an issue was exploitable but unable to prove it, and a 10s interaction with the maintainer was enough to uncover something serious. Exhausting these report channels is making this unfeasible. But the number of issues that will go undetected, that would have been detected with minimal collaboration between the reporter and the maintainer, is going to be high.
- grayhatter 10mo ago> Nice. But it deters people like me who aren't totally confident in sending reports, trading false positives for false negatives There's no such thing as a reasonable "false positive" on a security report. There is such a thing as a false positive on a bug report. (A real bug, that happens to have no security impact, is still a true positive, just without a security risk) If you can make it crash, or behave incorrectly, or have some repeatable, weird behavior; but you have no idea how you could exploit that for an articulable advantage, or access to the system you shouldn't have. What you have is a bug, not a security issue. You can, and should submit a bug report. Then, critically; "if you waste our time" seems to be an important part of the statement. If you don't know, you suspect it's a security bug because you shouldn't be able to do this, and it is leaking information that you think is suspicious, and you can easily demonstrate that you can make it happen on demand. And you report that bug, and make it easy for them to understand and either confirm the security, or reject because [reason]. You haven't wasted anyone's time and this wouldn't apply to your bug.
- jb1991 10mo agoIt sounds funny, but it's not. I once issued a bug to them that didn't have enough information about how to reproduce... and I was lambasted on Reddit and eventually just deleted my account there it was so terrifying. Some dev teams do not mess around. In fact I've shied off most social media since and no longer issue bug reports to any company, I was scarred deep over the treatment.
- TheDong 10mo agoI've read their reports before. When there's not enough information to reproduce, they do a good job of asking for more information first, and I've never seen a reasonable good-faith report elicit anything overt. If you failed to give them proper reproduction information when asked, then yeah, you were wasting their time and they should rightfully close your issue. I've never seen anyone on the curl team undeservedly "lambast" someone, and for a project that has a quite good reputation, I think the burden of proof is on you. Can you link to these supposedly terrifying comments?
- msephton 10mo agoIt says in the curl file that they will ridicule time-wasters in public and here is one pression confirming that it happened to them, yet somehow that's not enough? Come on.
- TingPing 10mo agoWe don’t need anecdotes, every single bug is public. Just looking now I see respectful responses to genuine reports. This document is clearly in response to AI slop and spam.
- perching_aix 10mo agoI skimmed the "slop" collection they maintain that was posted here yesterday, and even under those HackerOne submissions, Daniel was perfectly reasonable and respectful. It is entirely possible I merely chanced upon his highlights, but this announcement to me really just signifies a final straw breaking than anything else. His historical conduct is all public and speaks for itself. I wish I had the patience and perseverance he does, and I wish he didn't need it.
- egorfine 10mo agoIt is a bit naive to expect Indian students to even know about /security.txt existence, let alone reading it.
- gosub100 10mo agoI think this is the perfect application of a micro payment service. Each PR must be signed with a nominal amount of money, say $0.15 give or take. You send in a commit, with no expectation to get it back.
- regenschutz 10mo agoI think a deposit would be better then. You make a deposit of ¢15 for each issue and PR you open, and then the maintainers can decide to give it back to you if it was opened in good-faith/useful/merged/whatever policy they decide on.
- __turbobrew__ 10mo agoAgreed. Could be fiat or some sort of crypto currency that requires the submitter to have a vested interest in the outcome. Honestly, I would love it if I could front some money in order to have the devs look at my PRs. Half my PRs just go into the void and nobody looks at them until some staleness bot inevitably closes it. This is a similar problem to resume spam. I always wish I could pay $5 when submitting a resume with the guarantee that someone would actually look at it and give me a fair shot. If I ever run a place I want to experiment with only accepting resumes through letter mail or in person.
- gosub100 10mo agoI want to extend this idea to email. Use encryption, but for proof that the email can't be read, instead of for security/privacy (not that I'm against either of those). Update the email protocol so that all messages must be encrypted. Not "by default", but by necessity. The server rejects them if they aren't encrypted and signed in a way that proves the decryption key is on a block chain. The only way to put the key in the chain is to submit a micro payment. By "courtesy" , but completely subject to the recipient, the users client will refund the payment 48 hrs after it has been decrypted/read. Only if they click "spam" then the payment stays on their ledger. This would kill spam overnight. The two downsides I see so far are that the chain is a single point of failure for everyone, and it would cost people a few bucks and some friction to get the clients set up. Plus the coin would have to be very low transaction cost, and still fully redeemable for actual value somewhere.
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- sammy2255 10mo ago[flagged]
- quibono 10mo agoYou see the same thing with hundreds of CVEs assigned to random crap like PHPGurukul or Codeprojects. I.e. repositories of "tutorial" projects. Just like submitting a CVE for a vulnerability in OWASP's JuiceShop.
- NoSalt 10mo agoSeems fair.
- greenavocado 10mo agoI'll leave this chart to speak for itself https://ourworldindata.org/grapher/number-of-internet-users?country=OWID_NAM~IND https://ourworldindata.org/grapher/number-of-internet-users?...
- johnwheeler 10mo agoWhy do I always hear the cURL guy's opinions on this and that?
- GeorgeOldfield 10mo ago> ridicule you in public love this. more projects should use this kind of language. cut the bullshit
- farceSpherule 10mo ago[dead]
- Cort3z 10mo agoI wonder if there is a way to blanket prevent these types of problems. Possible solutions I can think of: - Require an account with a paid service. Fix = require money - Require an account verified with real ID/passport etc. Fix = link to real person - Automated reply system to "waste tokens" if it is an AI that is responding. Fix is increased cost of spammer. - Have some kind of "vetting system" where you get on an allowed list to report these types of things. Seems not good to me, but perhaps there is something in it. I wonder how much open source code is lost because maintainers must deal with this type of thing versus the "good" that AI can bring in productivity.
- smsm42 10mo agoThat would shut down all drive-by contributions, which may not be a good source of big improvements, but are a good source of information about bugs/maintenance issues. I.e. if I find a rare corner case where the code breaks, for an open source project I'd usually take some time to report it properly. But there's no way I'd pay for the privilege or bother to register with my governmental ID.
- Cort3z 10mo agoI agree, but if there were a common place where everyone did the registration once, it might be less of a problem. Something similar to the «verified» accounts on twitter etc. I can imagine GitHub becoming this filter somehow
- pixl97 10mo agoI've thought about this some and there are benefits and detractions in the processes. First requiring a deposit system. This might work in the sense that someone dedicated can put down $5 and report a bug, and even if it's not a bug but their work is legitimate they get refunded at the end of the process. - This doesn't scale well globally as $5 is nothing to me, but significant to someone that lives in a place almost no one in the US can pronounce correctly. - Once you become trusted you no longer need a deposit. - Most people what would submit a single, real, bug won't do this and you lose this information. - How is management of this deposit system paid for? How is fraud dealt with?
- deleted 10mo ago[deleted]
- b00ty4breakfast 10mo agoProjects are not going to be so open open their development process if they have to keep wading through emoji-filled and erroneous PRs. The Bazaar doesn't work so well if nobody can get around the piles of manure that are being delivered
- pixl97 10mo agohttps://en.wikipedia.org/wiki/Brandolini%27s_law https://en.wikipedia.org/wiki/Brandolini%27s_law Should be a highlight of the 2020's decade. It's not just open projects, it's anything that accepts unvetted information at all. Bug lists full of shit. Forums full of shit. News feeds full of fake shit. Ads full of fake shit. Cultural zeitgeist full of fake shit. Culture and society has not figured out how to inoculate themselves yet.
- b00ty4breakfast 10mo agoThis kind of automated industrial output is the foundation of our culture, it's not surprising that we aren't prepared for the virtual grey-goo of the LLM era that is our milieu brought to it's acme.
- MORPHOICES 10mo ago[dead]
- BLACKCRAB 10mo ago[dead]
- deleted 10mo ago[deleted]
- beloch 10mo agoWhile I understand the frustration with bad reports, this is how you get more of them (from the spiteful) and fewer good reports from the people you just threatened.
- ilovecurl 10mo agoI love curl.
- reneberlin 10mo agoA few weeks ago i saw a repo in Github that had closed the issue-board and explained the users: to move on to the discussions. If the discussion leads to the insight, that this is worth a feature, the maintainer will implement it. I think the same goes for PRs. If you think you have made something cool, then discuss it and offer your implementation and the maintainer makes it fit with you to integrate. On the other side, if you want a feature it just doesnt have, simply forking it and updating from the source-repo is fair enough.
- desipenguin 10mo agoBots/LLMs don't care if you ban and ridicule them in public.
- cynicalpeace 10mo agoMy instinct to this was: "This is literally patronizing" Threats are what every parent tells their child: "If you do X, I'll take away Y" For parenting, a limited form of this probably makes sense, because the parent has an authority over the child given by The Nature of Things. But between adults this mode of communication is grotesque, and it is more and more common. Especially amongst redditors, forum moderators, and other geeks of the ilk.
- freakynit 9mo agoI summarized all comments and overall discussion using LLM for better reading: https://hn-discussions.top/curl-crap-reports-bans/ https://hn-discussions.top/curl-crap-reports-bans/