in reply to daniel:// stenberg://

mastodon - Link to source

Josh Bressers

@quentinpradet

Back when I ran a bug bounty program, the HackerOne folks would suggest new bug hunters find projects that offer no rewards as a way to build up their reputation, as a bunch of the very large bounties only let people in with a reputation greater than some number

I also have a suspicion many of the slop reports are coming from people who decided they could use an LLM to make some quick cash because it told them it was awesome at ... well, everything

@Quentin Pradet
in reply to daniel:// stenberg://

mastodon - Link to source

jens persson

Not fully formed thought from the sideline. Perhaps it is possible to incur some kind of cost that is not monetary on the submitter, "You must have a reputation over X on Hackerone" or "You have to have something accepted into a 'well known' project".
Not sure how to implement and it would probably involve some change from Hackerone also.

Or start reviewing the submissions with AI 😉

in reply to daniel:// stenberg://

mastodon - Link to source

Kim Spence-Jones 🇬🇧😷

Maybe a crazy suggestion, but suppose it cost say $5 to submit a bug report eligible for the reward (but free if you don’t want to be eligible)? People who are confident their report is accurate won’t mind. People who are just AI spamming will think twice (or you get their money!)
If the prospect of a reward is driving the report submissions, that should slow down the slop. If something else is going on, that will become clear.
in reply to daniel:// stenberg://

mastodon - Link to source

Janik

I am following your situation with AI slop very closely. To my understanding the cost to generate a security report has become very cheap and HackerOne as a platform makes it quite easy to submit it to you without going through quality gates. Does it makes sense to increase the cost of submitting and generating a security report? I think of CI-pipline-like quality gates that check for arbitrary checks. Some proof-of-work checks that aim to increase the cost for slop reports.
in reply to daniel:// stenberg://

mastodon - Link to source

Karsten Johansson

I haven't seen the process, but do you require proof of vulnerability? I would ignore anything that doesn't come with proof. It's not like a vuln researcher wouldn't have proof on hand, just by the process of finding vulnerabilities in the first place.

Then you can focus on the proofs, and flat out deny any claims that come with insufficient pre-packaged proof.

⇧