Помните я писал, что Даниэль Стенберг (автор cURL) сгорел от нейропараши, которую сдают под видом уязвимостей в программу Bug Bounty?

https://t.me/tech_b0lt_Genona/5314

Эта идиотия продолжилась и cURL прекратил делать выплаты с конца января

cURL removes bug bounties
https://etn.se/index.php/nyheter/72808-curl-removes-bug-bounties.html

cURL has been flooded with AI-generated error reports. Now one of the incentives to create them will go away.

The vast majority of AI-generated error reports submitted to cURL are pure nonsense. Other open source projects are caught in the same pandemic.

”AI slop and bad reports in general have been increasing even more lately, so we have to try to brake the flood in order not to drown”, says cURL maintainer Daniel Stenberg to Swedish electronics industry news site etn.se.

“We hope this removes some of the incentives for people to send us garbage. We spend far too much time handling slop due to findings that are not real, exaggerated, or misunderstood.”

При всё при этом Bug Bounty до AI-спама реально приносила пользу

In total, 87 bug reports to cURL have over the years amounted to USD 101,020 in bounties.

В этой же статье обратились за комментарием к багхантеру Джошуа Роджерсу (Joshua Rogers) и он поддержал идею отказа от выплат не смотря на то что сам использует ИИ в своей работе

Interestingly, his reports were generated with the help of AI tools. But he doesn’t just vibe along in the dark — he reviews and adds to AI's analysis before submitting anything.

Despite being an active code vulnerabilities hunter himself, he thinks removing the bounty money is a stellar idea ; something that should have been done a long time ago.

“I think it's a good move and worth a bigger consideration by others. It's ridiculous that it went on for so long to be honest, and I personally would have pulled the plug long ago,”

И он не считает, что в случае с cURL отмена выплат сильно повлияет на результат, потому что cURL ковырять и найти там реальную багу это статусно само по себе

“Not much. The real incentive for finding a vulnerability in cURL is the fame ('brand is priceless'), not the hundred or few thousand dollars. $10,000 (maximum cURL bounty) is not a lot of money in the grand scheme of things, for somebody capable of finding a critical vulnerability in curl.”

Вообще, у Джошуа интересный блог и я иногда его почитываю (слава RSS-фиду у него на сайте 🌝)
https://joshua.hu/

Касательно выплат и вообще программ BB он высказался в итоговом посте 2025 года
My 2025 Bug Bounty Stories
https://joshua.hu/2025-bug-bounty-stories-fail

Главный его посыл "Нахера это всё надо в таком виде?". Выплаты не пойми какие, критерии такие же.

When cryptocurrency firms award a maximum of $10,000 for critical findings which could be used to steal $1,000,000, perhaps one can correctly guess why there is an impression that the divide between actual risk versus reward is imbalanced, such that one could also actually rationally conclude, “crime does pay”.

When companies set arbitrary rules which only hamper the efforts of whitehat hackers, while enabling blackhat hackers to thrive, then arbitrarily use those rules to discourage reporting of extremely serious issues, it begs the question, “why should I even bother? I can just play the lottery.”