zundon

Ars Technica NewsOpen source project curl is sick of users submitting “AI slop” vulnerabilities <a href="https://arstechni.ca/LAhpm" rel="nofollow noopener" translate="no" target="_blank">https://arstechni.ca/LAhpm</a> <a href="https://c.im/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilities</a> <a href="https://c.im/tags/bugreports" class="mention hashtag" rel="nofollow noopener" target="_blank">#bugreports</a> <a href="https://c.im/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> <a href="https://c.im/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://c.im/tags/Tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tech</a> <a href="https://c.im/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> <a href="https://c.im/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a>

daniel:// stenberg://I mentioned the <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> AI slop thing on <a href="https://mastodon.social/tags/LinkedIn" class="mention hashtag" rel="nofollow noopener" target="_blank">#LinkedIn</a>

Harry SintonenWhy does the <a href="https://infosec.exchange/tags/AISlop" class="mention hashtag" rel="nofollow noopener" target="_blank">#AISlop</a> problem exist at <a href="https://infosec.exchange/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> (and likely other bug bounty platforms)?Because apparently it works: <a href="https://hackerone.com/evilginx/hacktivity?type=user" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/evilginx/hacktivity?type=user</a>It seems that some projects pay bounties for such AI Slop reports.

daniel:// stenberg://While I can't be 100% sure, we (<a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a>) count 8 "AI slop" <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> submissions so far, which also makes it roughly 8% of the submissions over the last year as we get around 100 submissions per year right now. It makes it roughly as common as we get legitimate security problems reported.

daniel:// stenberg://Round two in our fun game: "slop or not?"(In here, the report is a rewrite of our previous published CVE in a way that I strongly suspect was done by an AI.)<a href="https://hackerone.com/reports/2912277" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2912277</a><a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a>

Harry Sintonen<a href="https://mastodon.social/@bagder" class="u-url mention" rel="nofollow noopener" target="_blank">@bagder</a> Good. This is a real problem and if they don't address it, it may end up hurting them in the end. If <a href="https://infosec.exchange/tags/Hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hackerone</a> is just full of AI "researches" posting endless AI slop reports, their clients will move on.

Harry Sintonen<a href="https://mastodon.social/@bagder" class="u-url mention" rel="nofollow noopener" target="_blank">@bagder</a> "it rather seems that AI slop now can help lazy incompetent researchers trick the system."Any AI slop should result in immediate ban or zeroing of the reputation.Will we see something like this from <a href="https://infosec.exchange/tags/Hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hackerone</a>? Considering their weird affection with AI I'm not expecting much to happen. As long as the quantity is the measuring stick rather than quality, nothing will happen.

daniel:// stenberg://Here's a link to today's AI slop <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report. Freshly disclosed: <a href="https://hackerone.com/reports/2887487" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2887487</a>

daniel:// stenberg://Marking them as spam now. <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> (AI slop as "security vulnerability reports")

daniel:// stenberg://Also <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a>: please STOP pushing your silly AI features to me. I don't care.

daniel:// stenberg://The original <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report for <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a>'s CVE-2024-7264: ASN.1 date parser overread is now published:<a href="https://hackerone.com/reports/2629968" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2629968</a>

daniel:// stenberg://it has been nearly three months since the last valid <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report against <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a>Just saying.I bet you can't find anything to report.🤠

Harry Sintonen<a href="https://infosec.exchange/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> project is so effective in resolving reports they've broken <a href="https://infosec.exchange/tags/Hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hackerone</a> <a href="https://hackerone.com/curl/policy_scopes" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/curl/policy_scopes</a>

daniel:// stenberg://the original <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report for CVE-2024-0853 is now public: <a href="https://hackerone.com/reports/2298922" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2298922</a>

daniel:// stenberg://For details on the <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> PSL vulnerability, check out the <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report. And if you use libpsl, double-check that your use is correct: <a href="https://hackerone.com/reports/2212193" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2212193</a>Two mentioned projects in this report in particular should check their code.

daniel:// stenberg://We disclosed this <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report against <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> when someone asked Bard to find a vulnerability, and it hallucinated together something: <a href="https://hackerone.com/reports/2199174" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2199174</a>

daniel:// stenberg://If you want to see the full <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> report and pre-disclosure discussion for the latest <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> CVE. Check this out: <a href="https://hackerone.com/reports/2039870" rel="nofollow noopener" translate="no" target="_blank">https://hackerone.com/reports/2039870</a>

daniel:// stenberg://First they submit junk security vulnerability reports at <a href="https://mastodon.social/tags/HackerOne" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerOne</a>.Then they whine when I close them as Not Applicable because that gives them a negative reputation.Maybe not submit the crap reports in the first place to avoid "ruining" your reputation?

daniel:// stenberg://Reminder: we always disclose the <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> <a href="https://mastodon.social/tags/hackerone" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackerone</a> issues including any discussions that let up to the disclosure of past CVEs. Today the last one from the previous release was made available: <a href="https://hackerone.com/curl/hacktivity?type=team" rel="nofollow noopener" target="_blank">https://hackerone.com/curl/hacktivity?type=team</a>

Recent searches

Search options

Administered by:

Server stats:

#hackerone