TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

New era of slop security reports for open source

34 点作者 detaro6 个月前

7 条评论

dmitrygr6 个月前
We here. Most of us (by age) at least. We have witnessed the entire lifetime of the useful internet. We saw as it rose and became useful and we are seeing it sink into the mire of easily-generated shit and become useless. We saw web search become a force for good (information availability) and we saw web search become useless trash. As the cost to produce shit drops, it will only get worse. The internet had a good run. The future, if any, is in closed communities by invitation only. However, that isn’t the Internet we knew and loved. <hat off in respect for the departed>
评论 #42342261 未加载
LilBytes6 个月前
This isn&#x27;t anything new, not something to celebrate but it&#x27;s certainly going to continue to increase.<p>Daniel (cURL) owner and maintainer went through something similar as LLMs just started, it&#x27;s covered in his blog post here:<p><a href="https:&#x2F;&#x2F;daniel.haxx.se&#x2F;blog&#x2F;2024&#x2F;01&#x2F;02&#x2F;the-i-in-llm-stands-for-intelligence&#x2F;" rel="nofollow">https:&#x2F;&#x2F;daniel.haxx.se&#x2F;blog&#x2F;2024&#x2F;01&#x2F;02&#x2F;the-i-in-llm-stands-f...</a><p>Comically covered by The Primeagen here: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=e2HzKY5imTE&amp;t=1206s" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=e2HzKY5imTE&amp;t=1206s</a><p>Previous conversations: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38845878">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38845878</a>, 121 comments<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38840907">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38840907</a>, 8 comments
评论 #42351094 未加载
tommiegannert6 个月前
&gt; DO NOT spam projects, open a handful of reports and then WAIT. You could run the script and open tons of reports all-at-once, but likely you have faults in your process that will cause mass-frustration at scale. Learn from early mistakes and feedback.<p>I saw something similar with wasm3, a project explicitly said to be in maintenance mode, because the maintainer is in the Ukraine and being busy with other stuff... I managed to triage and provide patches to some of them. The poster was doing fuzz testing by randomly generating WASM binaries. Once a crash was found, they just uploaded the binary as-was, with error message. Completely valid reports, but bad execution with context in mind.<p>This resulted in huge WASM binaries that could be reduced from thousands of instructions to ten with work. (Even that reduction could probably have been automated, which annoys me even more.) There were also duplicates because they posted 5-10 reports simultaneously, many with the same cause. This is something I feel they should have done ahead of posting.<p>&gt; DO NOT submit reports that haven&#x27;t been reviewed BY A HUMAN. This reviewing time should be paid first by you, not open source volunteers.<p>This seems like the most important point. LLMs are great for generating things. By all means, continue using them. Sometimes useful, sometimes not. It can be inspiring if used right. They are pattern matchers after all, and bug hunting is partially about finding patterns. However, GIGO, and they need a filter after.<p>(If you like using a hammer to fix dents in my car, don&#x27;t say you&#x27;re done just because you&#x27;ve had a few blows; tell me it&#x27;s done when the dents are gone.)
Havoc6 个月前
It’s wild to me that people think they’re helping by unleashing this on open source.
评论 #42314738 未加载
mnau5 个月前
&gt; Take away any positive incentive to reporting security issues, for example GitHub showing the number of GitHub Security Advisory &quot;credits&quot; a user appears on.<p>Fully agree. This is something github can do. When claims are unverifiable, it should stop resume padding.
fargle6 个月前
&gt; &quot;I suspect this report is (AI-generated|incorrect|spam). Please respond with more justification for this report. See: <a href="https:&#x2F;&#x2F;sethmlarson.dev&#x2F;slop-security-reports" rel="nofollow">https:&#x2F;&#x2F;sethmlarson.dev&#x2F;slop-security-reports</a>&quot;<p>could an AI bot be trained to recognize low-quality security reports and automatically respond as such?<p>at the risk of escalating the inevitable arms race, of course.
cdchn6 个月前
Whats the end game here? Bug bounties? Notoriety? Bogus OKRs?
评论 #42314856 未加载