Hacker News Reader

Comment by mrkeen | Hacker News Reader

Daniel Stenberg has been vocal the last few months on Mastodon about being overwhelmed by false security issues submitted to the curl project.

So much so that he had to eventually close the bug bounty program.

https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-b...

View on HN

We're discussing a project led by actual vulnerability researchers, not random people in Indonesia hoping to score $50 by cajoling maintainers about atyle nits.

Vulnerability researches with a vested interest in making LLMs valuable. The difference isn't meaningful

I don't even understand how that claim makes sense.

The first three authors, who are asterisked for "equal contribution", appear to work for Anthropic. That would imply an interest in making Anthropic's LLM products valuable.

What is the confusion here?

The notion that a vulnerability researcher employed by one of the highly-valued companies in the hemisphere, publishing in the open literature with their name signed to it, is on a par with a teenager in a developing nation running script-kid tools hoping for bounty payoffs.

To preemptively clarify, I'm not saying anything about these particular researchers.

Having established that, are you saying that you can't even conceptualize a conflict of interest potentially clouding someone's judgement any more if the amount of money and the person's perceived status and skill level all get increased?

Disagreeing about the significance of the conflict of interest is one thing, but claiming not to understand how it could make sense is a drastically stronger claim.

I'm responding to "the difference isn't meaningful". Obviously, the difference is extremely meaningful.

> Having established that, are you saying that you can't even conceptualize a conflict of interest potentially clouding someone's judgement any more if the amount of money and the person's perceived status and skill level all get increased.

If I used AI to make a Super Nintendo soundtrack, no one would treat it as equivalent to Nobuo Uematsu or Koji Kondo or Dave Wise using AI to do the same and making the claim that the AI was managing to make creatively impressive work. Even if those famous composers worked for Anthropic.

Yes there would be relevant biases but there could not be a comparison of my using AI to make music slop vs. their expert supervision of AI to make something much more impressive.

Just because AI is involved in two different things doesn't make them similar things.

No one is saying he is misleading people on purpose, just that he may lack critical evaluation of his product, or be overly optimistic about it.

I'm not sure the gap between the two is all that wide

Then you're telling on yourself.

Yep, very meaningful difference indeed. It's not like professionals have ever have had a vested interest to spread misinformation to shill a product.

It's not like there were ads with real doctors recommending Camel cigarettes.

It's not like the browser "breakthrough" recently which pulled 300 OSS dependencies together, removed attribution and called the mess "working".

The desperation of the Samas, Musks, Satyas and Anthropics of this world and their fanbase to paint marginal 0.0001337% improvements in a gamed SWE ranking as something worth any attention is just delicious. Opus 4.6? Please, more like Opus 4.5.0.2-RC. All I hear is the sound of a bubble going pop. Delightful.

> in Indonesia

That's uncalled for.. there's actual security researches in Indonesia and other countries you could use to exemplify this

You're right. I'm sorry about that. I know there are, and there's no reason to single out Indonesia in particular.

Daniel is a smart man. He's been frustrated by slop, but he has equally accepted [0] AI-derived bug submissions from people who know what they are doing.

I would imagine Anthropic are the latter type of individual.

[0]: https://mastodon.social/@bagder/115241241075258997

Not only that, he's very enthusiastic about AI analyzers such as ZeroPath and AISLE.

He's written about it here: https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyz... and talked about it in his keynote at FOSDEM - which I attended - last Sunday (https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-o...).

Reply on news.ycombinator.com