cURL removes bug bounties (etn.se)

Article summary

The cURL open source code library is removing its bug bounty program due to an influx of low-quality, AI-generated bug reports. The library's maintainers hope that this will reduce the number of useless reports they receive. The decision is supported by a well-known bug hunter, who believes that the bounty money was not a significant incentive for legitimate bug reporters. The library has paid out over $100,000 in bounties over the years, but the majority of recent reports have been deemed worthless.

Main themes

• bug bounty programs
• AI-generated bug reports
• open source software maintenance
• incentives for bug reporting
• cordless vacuums
• effort and motivation
• AI and automation
• software development and testing

What commenters say

• The removal of bug bounties is a good move to reduce the number of low-quality reports.
• An entry fee that is reimbursed if the bug turns out to be legitimate could be an effective way to stop useless reports.
• The quality of bug reports has decreased significantly since the emergence of AI-generated reports.
• Some commenters disagree on the effectiveness of cordless vacuums, with some finding them useful and others preferring traditional corded models.
• The reimbursement for bug reports should be based on whether a reasonable person could consider the report to be a legitimate vulnerability.
• The use of AI-generated reports may be a deliberate attempt to overwhelm reviewers and crowd out real reports.
• The decision to remove bug bounties may disproportionately affect bug reporters from low socio-economic locations who rely on the bounty money as a significant incentive.