Shameless plug @Codeberg

#fosdem #SERVFAIL

RE: https://mastodon.social/@bagder/115893088600630096

This is should be a wider discussion in the security industry. Sustainability!

It’s important to realize that for (small) open source projects, even reports of real security issues with real impact are significant workloads.
They need to be reviewed, understood, fixes designed.

And those fixes may have further effects like compatibility breakage or redesigns.
If done correctly this is a lot of work, work that those developers usually do unpaid. If they have the time.

Bug bounties may increase the amount of code review and hopefully increase the security of a project due to the amount of eyes on it, but they need to be in sync with the needed resources for the project to review and act on those reports.

What if a bug bounty program paid both the finder and the open source project for fixing an issue?

Due to repeated infringements

RE: https://infosec.exchange/@Euph0r14/115537025466307863

Unrelatedly, at least 10 players agentic AI happily sent us their host name, username, team name and Timezone when they fell into our carefully placed LLM trap in one of our #haix2025 challenges :blobcatthinksmart:

It’s fantastic to realize that even after all this time and “prompt injection” scare, “AI” coding agents are still more than happy to execute whatever a malicious project tells them to, if done carefully.

Surely managers dream of handing all future software development (or anything really) to statistical black boxes will have no ill side effects.