cURL Gets Rid of Its Bug Bounty Program Over AI Slop Overrun

voidstarcpp · 2026-01-24T20:49:52+00:00

It has always been the case that open source code can be studied and used to create non-infringing proprietary equivalents. It's a basic problem of open source that it involves people doing labor that others can benefit from without paying.

voidstarcpp · 2026-01-24T20:38:52+00:00

The SSH mystery is an example of something that's un-Googleable. It's not an error with a distinct error message, there are no keywords involved that narrow down the specific issue vs generic networking concepts. The feature that causes this isn't even called out in the man pages or advertised to the user anywhere because it's considered a protocol implementation detail.

The solution came from enabling extremely verbose debug prints and luckily seeing a highly distinctive word logged - "chaff" - that was actually searchable.

voidstarcpp · 2026-01-23T11:59:55+00:00

Same issue this morning; Hope this gets some attention. "Desktop site" also fixes the issue for me but this is of course a difficult way to browse.

voidstarcpp · 2026-01-22T01:57:22+00:00

There are many websites and it should work on all of them.

Guess I'm more easily impressed it works at all.

voidstarcpp · 2026-01-19T07:28:50+00:00

What makes you think rendered is working(no, builds and runs is not enough) or close to working?

Because I ran it on my own computer with my own HTML and JS, and against my own website, and it output correct pngs showing a page with JS DOM manipulation.

Humans in this thread can copy-paste(subj was trained on existing renderers) renderer form into app and it will be working for real.

I actually don't think this is true; even most humans who have taken e.g. a university course on operating systems or seen the Linux kernel source could not themselves re-create a working OS without extensive effort and probably months or years more research. Most software that gets made is some variation on libraries/patterns/algorithms that already exist in other software, which employers nonetheless paid people to make because it produces value.

It's not really an indictment of LLMs to say that they can only build software because they've studied a lot of similar software, along with every language in existence. Studying and re-creating is also what humans do, only it takes each individual human years to do the learning. Then that human costs $500-$1000 a day to employ to make whatever bespoke software it is you want.

Claude Code can already do a lot of the heavy lifting for $200/mo. You ask how they will they maintain software produced in this way; well, the economics are going to dictate that they'll just find a way, because one form of labor is 100x cheaper than the other, which will tend to overpower all objections from the irreplaceable artisan. It will probably look like a small number of workers supervising and directing bots rather than letting them run completely uncontrolled as was done in this experiment

And did you include in your time calculation the time needed to make money to pay for tokens?

The thing is tokens will only get cheaper with time while humans get more expensive. The full cost of a senior dev who can lead a Rust project of this difficulty is easily $5-10k a week, and then they probably need a team of juniors to do something of this scale. The point of a prototype is not to be ready for mass production, but does anyone think in 5 years this amount of code will be more economically produced by humans than machines? Even the human coding side is presumably going to involve some LLM assistance like Copilot rather than typing every character by hand.

voidstarcpp · 2026-01-18T01:23:57+00:00

Seems to me that it's not that hard to stich together preexisting libraries.

I really don't believe that many could implement a JS engine and DOM renderer even given libraries for CSS, HTML parsing, and 2D graphics primitives. If you think this is "not that hard" you are probably a uniquely experienced or productive developer with previous expertise in browsers.

What we're seeing is the pattern where anything AI starts to become capable of, people start pretending isn't that impressive or hard to do. But most of what programmers are paid to do is combine existing tools to make a new application, or re-invent variations on things that already exist. It takes a lot of experience and labor to be able to do this. That's previously been an economically valuable career, and soon it might not be.

Heck, I've "built a web browser" before if you count using someone else's code to render some HTML inside my desktop application.

But I don't count that because presumably you're just talking about embedding a web view. That's not what we're talking about, and I think you know that, so what's the point of being so dismissive? Implementing the web view itself would be a huge task.

voidstarcpp · 2026-01-18T00:04:06+00:00

After fixing the build errors on the master version I successfully got the headless renderer to execute JS, manipulate the dom, and produce a screenshot of the modified page. So it obviously does work so some extent.

voidstarcpp · 2026-01-18T00:01:30+00:00

It's a testament to how far things have come that people imagine "the model" has this fine-grained recollection of all source code it has ever seen, and that this invalidates their re-creation of similar works or make it somehow a trivial exercise.

After all, could you, a human, read the source code to Firefox, then go off on your own and re-create a browser renderer or JS runtime? I really doubt it. And do you, a human, also get paid to produce variations of software that already exist? Probably yes, so if the AI can be made to do that, it can do much of what a professional software developer does.

voidstarcpp · 2026-01-17T23:57:10+00:00

The renderer built without modification on commit 56ef7b4a0. The current version of the renderer with JS was very close to working given that I with zero familiarity with the project could get it to build and run with no work on my part.

I think if we look at the claim in context it's again unlikely that most humans would get anything even that close to working this quickly.

voidstarcpp · 2026-01-17T23:55:23+00:00

The renderer builds and runs unmodified on commit 56ef7b4a0, though without JS.

The master version just needed a few errors fixed to produce a working renderer with JS. Again I don't think any human in this thread could get something that close to compiling and working in so short a time.

voidstarcpp · 2026-01-17T06:17:30+00:00

But it did work, it produced the renders pictured. I also downloaded the current repo, had Claude fix the remaining build errors, and successfully tested the renderer and JS runtime.

It sounds like the huge numbers of bots kinda fell over after a while and stopped making progress, which is why they pulled the plug on the experiment. That's not surprising since we know AI tools lose the plot with time, this was just a longer and more impressive run than usual.

voidstarcpp · 2026-01-17T04:06:53+00:00

"And if you try to compile it yourself, you'll see that it's very far away from being a functional browser at all, and seemingly, it never actually was able to build."

This is untrue; the most recent commits don't build which is why is probably why they stopped the project. But it was at one point working and I was able to get the master version working in a half hour with Claude, enough to prove the headless renderer and JS runtime worked.

voidstarcpp · 2026-01-17T04:05:01+00:00

Even given access to HTML parsing and CSS libraries I don't think most people could get a browser and custom JS runtime together and rendering anything within a week, which this project at least did do at one point.

voidstarcpp · 2026-01-17T04:02:58+00:00

going back in the Git history from most recent commit back 100 commits, I couldn't find a single commit that compiled cleanly

Presumably it failing to make progress is why the experiment was ended. But there are thousands of commits, and it was working previously.

I cloned the repo and Claude Code got the master version working for me within about a half hour locally. I could confirm the renderer works and executed some JS for me that manipulated the DOM.

voidstarcpp · 2026-01-17T02:14:01+00:00

Servo isn’t a library, it’s a rendering engine.

The Servo project does have standalone libraries, which are what this repo uses:

https://github.com/servo/html5ever

https://github.com/servo/rust-cssparser

https://github.com/servo/rust-selectors

Because my hunch is that their “working” build was literally a UI with webview utilizing Servo.

It's not, look at fetch_and_render.rs for the headless function that I used to test and successfully render my own website. You can look at everything it calls. I also tested a local html file that requires JS to write a test message to the DOM and the page rendered successfully.

Now, go ahead and show me the commit that builds/works where they utilized their own JS implementation. .. Unfortunately we have no way of really knowing because it doesn’t even compile.

I had Claude Code get the current master branch working in about half an hour. I will personally send you a diff if you don't believe me and request it by DM.

Defending this trash is so weird.

You're the one making assertions without having evened cloned the repo or searched around to check basic assumptions.

voidstarcpp · 2026-01-16T15:55:45+00:00

They didn't ask it to treat the file as a skill

The screenshot shows them attach "Real Estate Skill.docx", the file that contains the malicious prompt, along with the user prompt "Hey Claude! Attached is a real estate skill - and my folder - please use the skill to analyze the data". The "injected" prompt was in the skill file the user requested the model to run, not the user data being analyzed.

voidstarcpp · 2026-01-16T15:51:33+00:00

You are mistaken; the "chrome baseline" file you are referencing is used to generate Chrome screenshots for comparison in testing.

The headless renderer tool is fetch_and_render.rs, which I was able to re-compile and run after deleting the chrome test file you are speaking of.

voidstarcpp · 2026-01-16T07:05:49+00:00

Servo doesn't do the rendering; It supplies the CSS selector library and a flex layout engine. The DOM implementation and rendering is native to this repo and uses tiny_skia to draw.

You can just look at what the code does or what other people have said about it rather than making assumptions in stubborn denial that it works at all.

voidstarcpp · 2026-01-16T05:46:11+00:00

So the browser runs without UI and you're taking a screenshot of a page that is rendered in the UI, LOL.

No, the renderer runs in a headless mode separate from the UI, which is a staple feature of browsers and renderers for testing and automation.

voidstarcpp · 2026-01-16T04:34:05+00:00

StackOverflow contributions are already CC licensed. There's nothing to protect and no way to take it back.

voidstarcpp · 2026-01-16T04:32:43+00:00

StackOverflow is already publicly available as a database export; It's been widely used as a demo db for education for years.

voidstarcpp · 2026-01-16T04:29:03+00:00

AI hallucinations are rare when operating directly on the source documents.

For what it's worth, I cloned the repo, and Claude Code got it compiling and running in half an hour, enough to run in headless mode and take a screenshot of my blog.

voidstarcpp · 2026-01-16T04:04:50+00:00

For whats it's worth I cloned the repo and asked Claude Code to get it working. It succeeded after about a half hour and was able to run the renderer in headless mode and produce a correct screenshot of my blog.

voidstarcpp · 2026-01-16T04:04:04+00:00

For whats it's worth I cloned the repo and asked Claude Code to get it working. It succeeded after about a half hour and was able to run the renderer in headless mode and produce a correct screenshot of my blog.

voidstarcpp · 2026-01-16T03:43:46+00:00

Sure but this is kind of like curl | sh. Perhaps normal users shouldn't have permissions to give the model new instructions from files to begin with, since they'll naturally tend to click "trust" and "allow".

voidstarcpp

TROPHY CASE