4 ms·

I suppose eventually we'll see something like Google's OSS-Fuzz for core open source projects, maybe replacing bug bounty programs a bit. Anthropic already hand

by est31 7mo ago

I suppose eventually we'll see something like Google's OSS-Fuzz for core open source projects, maybe replacing bug bounty programs a bit. Anthropic already hands out Claude access for free to OSS maintainers. LLMs made it harder to run bug bounty programs where anyone can submit stuff, and where a lot of people flooded them with seemingly well-written but ultimately wrong reports. On the other hand, the newest generation of these LLMs (in their top configuration) finally understands the problem domain well enough to identify legitimate issues. I think a lot of judging of LLMs happens on the free and cheaper tiers, and quality on those tiers is indeed bad. If you set up a bug bounty program, you'll necessarily get bad quality reports (as cost of submission is 0 usually). On the other hand, if instead of a bug bounty program you have an "top tier LLM bug searching program", then then the quality bar can be ensured, and maintainers will be getting high quality reports. Maybe one can save bug bounty programs by requiring a fee to be paid, idk, or by using LLM there, too.

suddenlybananas 7mo ago
> Anthropic already hands out Claude access for free to OSS maintainers. Free for 6 months after which it auto-renews if I recall correctly.
- mceachen 7mo ago
  No mention of auto renewal is made as far as I (and Claude) could determine. Their OSS offer is first-hit-is-free.
- neobrain 7mo ago
  > Free for 6 months after which it auto-renews if I recall correctly. They don't ask for credit card information when signing up this way, so even if true you won't be charged if you forget canceling.
sigmar 7mo ago
>where a lot of people flooded them with seemingly well-written but ultimately wrong reports. are there any projects to auto-verify submitted bug reports? perhaps by spinning up a VM and then having an agent attempt to reproduce the bug report? that would be neat.
mccr8 7mo ago
Google already has an AI-powered security vulnerability project, called Big Sleep. It has reported a number of issues to open source projects: https://issuetracker.google.com/savedsearches/7155917?pli=1 https://issuetracker.google.com/savedsearches/7155917?pli=1

by est31 7mo ago

suddenlybananas 7mo ago

> Anthropic already hands out Claude access for free to OSS maintainers. Free for 6 months after which it auto-renews if I recall correctly.

mceachen 7mo ago
No mention of auto renewal is made as far as I (and Claude) could determine. Their OSS offer is first-hit-is-free.
neobrain 7mo ago
> Free for 6 months after which it auto-renews if I recall correctly. They don't ask for credit card information when signing up this way, so even if true you won't be charged if you forget canceling.

sigmar 7mo ago

>where a lot of people flooded them with seemingly well-written but ultimately wrong reports. are there any projects to auto-verify submitted bug reports? perhaps by spinning up a VM and then having an agent attempt to reproduce the bug report? that would be neat.

mccr8 7mo ago

Google already has an AI-powered security vulnerability project, called Big Sleep. It has reported a number of issues to open source projects: https://issuetracker.google.com/savedsearches/7155917?pli=1 https://issuetracker.google.com/savedsearches/7155917?pli=1