jacobian @jacob@social.jacobian.org
Public

Bug Bounties have always been a sort of medium-value program. They do generate measurable security improvement, reliably — more than can be said for many security programs! — but they also cost a lot of time in triage, reproduction and communication. Historically the juice has been worth the squeeze, but with the rise of slop reports that’s no longer true. I suspect we’ll see a lot more bounty programs quietly (or loudly) end soon. cyberplace.social/@GossiTheDog

Kevin Beaumont (@GossiTheDog@cyberplace.social)

Curl, one of the largest and widely used open source projects, is to stop bug bounty at the end of this month due to being overwhelmed by Generative AI slop bug bounty reports. https://github.com/curl/curl/pull/20312

cyberplace.social · Cyberplace

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://social.jacobian.org/users/jacob/statuses/115935033329971484 on your instance and quote it. (Note that quoting is not supported in Mastodon.)