News for hackers. Stuff that matters.
Re:cURL removes bug bounties by zrm on Wednesday January 21, 2026 @02:54AM (#46702463)
Triage gets outsourced because the quality of reports is low.

If filing a bad report costs money, low quality reports go down. Meanwhile anyone still doing it is funding your top notch security team because then they can thoroughly investigate the report and if it turns out to be nothing then the reporter ends up paying them for their time.

Re:cURL removes bug bounties by nospice on Wednesday January 21, 2026 @11:05AM (#46707581)
My point is that on average, filing bad but plausibly-sounding reports makes the reporter money. Curl is the odd exception with naming-and-shaming, not the rule. Spamming H1 with AI-generated reports is lucrative. A modest deposit is unlikely to change that. A big deposit (thousands of dollars) would, but it would also discourage a lot of legitimate reports.