4 ms·

Daniel Stenberg has been vocal the last few months on Mastodon about being overwhelmed by false security issues submitted to the curl project. So much so that

by mrkeen 9mo ago

Daniel Stenberg has been vocal the last few months on Mastodon about being overwhelmed by false security issues submitted to the curl project. So much so that he had to eventually close the bug bounty program. https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/ https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-b...

tptacek 9mo ago
We're discussing a project led by actual vulnerability researchers, not random people in Indonesia hoping to score $50 by cajoling maintainers about atyle nits.
- malfist 9mo ago
  Vulnerability researches with a vested interest in making LLMs valuable. The difference isn't meaningful
  - tptacek 9mo ago
    I don't even understand how that claim makes sense.
    - judemelancon 9mo ago
      The first three authors, who are asterisked for "equal contribution", appear to work for Anthropic. That would imply an interest in making Anthropic's LLM products valuable. What is the confusion here?
      - tptacek 9mo ago
        The notion that a vulnerability researcher employed by one of the highly-valued companies in the hemisphere, publishing in the open literature with their name signed to it, is on a par with a teenager in a developing nation running script-kid tools hoping for bounty payoffs.
        delusional 9mo ago
        [flagged]
        tptacek 9mo ago
        I don't even understand how that claim makes sense.
        malfist 9mo ago
        You're doing a fine job demonstrating the problem we're talking about here.
        judemelancon 9mo ago
        To preemptively clarify, I'm not saying anything about these particular researchers. Having established that, are you saying that you can't even conceptualize a conflict of interest potentially clouding someone's judgement any more if the amount of money and the person's perceived status and skill level all get increased? Disagreeing about the significance of the conflict of interest is one thing, but claiming not to understand how it could make sense is a drastically stronger claim.
        tptacek 9mo ago
        I'm responding to "the difference isn't meaningful". Obviously, the difference is extremely meaningful.
        mpyne 9mo ago
        > Having established that, are you saying that you can't even conceptualize a conflict of interest potentially clouding someone's judgement any more if the amount of money and the person's perceived status and skill level all get increased. If I used AI to make a Super Nintendo soundtrack, no one would treat it as equivalent to Nobuo Uematsu or Koji Kondo or Dave Wise using AI to do the same and making the claim that the AI was managing to make creatively impressive work. Even if those famous composers worked for Anthropic. Yes there would be relevant biases but there could not be a comparison of my using AI to make music slop vs. their expert supervision of AI to make something much more impressive. Just because AI is involved in two different things doesn't make them similar things.
- PunchyHamster 9mo ago
  I'm not sure the gap between the two is all that wide
  - tptacek 9mo ago
    Then you're telling on yourself.
- ath3nd 9mo ago
  Yep, very meaningful difference indeed. It's not like professionals have ever have had a vested interest to spread misinformation to shill a product. It's not like there were ads with real doctors recommending Camel cigarettes. It's not like the browser "breakthrough" recently which pulled 300 OSS dependencies together, removed attribution and called the mess "working". The desperation of the Samas, Musks, Satyas and Anthropics of this world and their fanbase to paint marginal 0.0001337% improvements in a gamed SWE ranking as something worth any attention is just delicious. Opus 4.6? Please, more like Opus 4.5.0.2-RC. All I hear is the sound of a bubble going pop. Delightful.
- nextaccountic 9mo ago
  > in Indonesia That's uncalled for.. there's actual security researches in Indonesia and other countries you could use to exemplify this
  - tptacek 9mo ago
    You're right. I'm sorry about that. I know there are, and there's no reason to single out Indonesia in particular.
pityJuke 9mo ago
Daniel is a smart man. He's been frustrated by slop, but he has equally accepted [0] AI-derived bug submissions from people who know what they are doing. I would imagine Anthropic are the latter type of individual. [0]: https://mastodon.social/@bagder/115241241075258997 https://mastodon.social/@bagder/115241241075258997
- catwell 9mo ago
  Not only that, he's very enthusiastic about AI analyzers such as ZeroPath and AISLE. He's written about it here: https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/ https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyz... and talked about it in his keynote at FOSDEM - which I attended - last Sunday (https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-of-ai/ https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-o...).
kyleee 9mo ago
[flagged]

by mrkeen 9mo ago

tptacek 9mo ago

We're discussing a project led by actual vulnerability researchers, not random people in Indonesia hoping to score $50 by cajoling maintainers about atyle nits.

malfist 9mo ago
Vulnerability researches with a vested interest in making LLMs valuable. The difference isn't meaningful
- tptacek 9mo ago
  I don't even understand how that claim makes sense.
  - judemelancon 9mo ago
    The first three authors, who are asterisked for "equal contribution", appear to work for Anthropic. That would imply an interest in making Anthropic's LLM products valuable. What is the confusion here?
    - tptacek 9mo ago
      The notion that a vulnerability researcher employed by one of the highly-valued companies in the hemisphere, publishing in the open literature with their name signed to it, is on a par with a teenager in a developing nation running script-kid tools hoping for bounty payoffs.
      - delusional 9mo ago
        [flagged]
        tptacek 9mo ago
        I don't even understand how that claim makes sense.
        malfist 9mo ago
        You're doing a fine job demonstrating the problem we're talking about here.
      - judemelancon 9mo ago
        To preemptively clarify, I'm not saying anything about these particular researchers. Having established that, are you saying that you can't even conceptualize a conflict of interest potentially clouding someone's judgement any more if the amount of money and the person's perceived status and skill level all get increased? Disagreeing about the significance of the conflict of interest is one thing, but claiming not to understand how it could make sense is a drastically stronger claim.
        tptacek 9mo ago
        I'm responding to "the difference isn't meaningful". Obviously, the difference is extremely meaningful.
        mpyne 9mo ago
        > Having established that, are you saying that you can't even conceptualize a conflict of interest potentially clouding someone's judgement any more if the amount of money and the person's perceived status and skill level all get increased. If I used AI to make a Super Nintendo soundtrack, no one would treat it as equivalent to Nobuo Uematsu or Koji Kondo or Dave Wise using AI to do the same and making the claim that the AI was managing to make creatively impressive work. Even if those famous composers worked for Anthropic. Yes there would be relevant biases but there could not be a comparison of my using AI to make music slop vs. their expert supervision of AI to make something much more impressive. Just because AI is involved in two different things doesn't make them similar things.
PunchyHamster 9mo ago
I'm not sure the gap between the two is all that wide
- tptacek 9mo ago
  Then you're telling on yourself.
ath3nd 9mo ago
Yep, very meaningful difference indeed. It's not like professionals have ever have had a vested interest to spread misinformation to shill a product. It's not like there were ads with real doctors recommending Camel cigarettes. It's not like the browser "breakthrough" recently which pulled 300 OSS dependencies together, removed attribution and called the mess "working". The desperation of the Samas, Musks, Satyas and Anthropics of this world and their fanbase to paint marginal 0.0001337% improvements in a gamed SWE ranking as something worth any attention is just delicious. Opus 4.6? Please, more like Opus 4.5.0.2-RC. All I hear is the sound of a bubble going pop. Delightful.
nextaccountic 9mo ago
> in Indonesia That's uncalled for.. there's actual security researches in Indonesia and other countries you could use to exemplify this
- tptacek 9mo ago
  You're right. I'm sorry about that. I know there are, and there's no reason to single out Indonesia in particular.

pityJuke 9mo ago

Daniel is a smart man. He's been frustrated by slop, but he has equally accepted [0] AI-derived bug submissions from people who know what they are doing. I would imagine Anthropic are the latter type of individual. [0]: https://mastodon.social/@bagder/115241241075258997 https://mastodon.social/@bagder/115241241075258997

catwell 9mo ago
Not only that, he's very enthusiastic about AI analyzers such as ZeroPath and AISLE. He's written about it here: https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/ https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyz... and talked about it in his keynote at FOSDEM - which I attended - last Sunday (https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-of-ai/ https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-o...).

kyleee 9mo ago

[flagged]