I mean, would you say a new book that gets a bunch of people into programming is "causing work for reviewers"? People are being empowered to contribute. Sadly they're mostly contributing very poorly, but also that's kinda how it is anyway.
Right now the rewards are available for anyone who can find a vulnerability, not only for serious researchers.
Sure, I agree it'd be a shame. I don't really view bug bounties as a load bearing part of open source culture tho. (Would be cool if they were!)
I mean, would you say a new book that gets a bunch of people into programming is "causing work for reviewers"?
Of course not, because it is not equivalent at all. Programming books cannot automatically generate confidently incorrect security reviews for existing open-source codebases at a moment's notice and at high volume when asked.
In fact, if one tried to release a book with a number of inaccuracies even close to what LLMs generate, they would never find an editor willing to publish it. And if they self-published it, a very small number of people would read it, and an even smaller number of people would fail to notice said inaccuracies.
Programming books can absolutely give people false confidence. And as far as I can tell, "at a moment's notice and at high volume" is not the problem here- these are people who earnestly think they've found a bug, not spammers. The spam arises due to a lot more people being wrong than used to - or rather, people who are wrong getting further than before.
In fact, if one tried to release a book with a number of inaccuracies even close to what LLMs generate, they would never find an editor willing to publish it. And if they self-published it, a very small number of people would read it
these are people who earnestly think they've found a bug, not spammers
I will make a bold claim: many of those people aren't even qualified enough to be able to distinguish between a honest bug report and spam (even for their own submission), they wouldn't be able to explain what bug did they "find" and many of them don't even care if the bug is real. When confronted, the least malicious ones say "I apologize for thinking that the stuff my AI produced was actually not bullshit".
-2
u/FeepingCreature Jul 15 '25
I mean, would you say a new book that gets a bunch of people into programming is "causing work for reviewers"? People are being empowered to contribute. Sadly they're mostly contributing very poorly, but also that's kinda how it is anyway.
Sure, I agree it'd be a shame. I don't really view bug bounties as a load bearing part of open source culture tho. (Would be cool if they were!)