Nachdem Trump nun auch Ministerinnen entlässt, frage ich mich, ob Kanzler Merz nach allen Verfehlungen von Gaslobbyiistin Reiche wirklich an ihr festhalten will. Ihre Pläne beim GEG (jetzt Gebäudemonderinsierungsgesetz) und beim EEG sind sehr problematisch und nutzen nur Putin/Trump&Co
06.03.2026 11:23
👍 48
🔁 5
💬 4
📌 0
Over 40% of global shipping by volume exists to move fossil fuels from one place to another.
A huge share of the world's maritime infrastructure has been built around a system that is going to change dramatically as renewable energy and electrification displace fossil fuels.
04.03.2026 11:05
👍 763
🔁 354
💬 34
📌 33
The end of the curl bug-bounty
tldr: an attempt to reduce the _terror reporting_.
**There is no longer a curl bug-bounty program.** It officially stops on January 31, 2026.
After having had a few half-baked previous takes, in April 2019 we kicked off the first real curl bug-bounty with the help of Hackerone, and while it stumbled a bit at first it has been quite successful I think.
We attracted skilled researchers who reported plenty of actual vulnerabilities for which we paid fine monetary rewards. We have certainly made curl better as a direct result of this: **87 confirmed vulnerabilities and over 100,000 USD** paid as rewards to researchers. I’m quite happy and proud of this accomplishment.
I would like to especially highlight the awesome Internet Bug Bounty project, which has paid the bounties for us for many years. We could not have done this without them. Also of course Hackerone, who has graciously hosted us and been our partner through these years.
Thanks!
## How we got here
Looking back, I think we can say that the downfall of the bug-bounty program started slowly in the second half of 2024 but accelerated badly in 2025.
We saw an explosion in AI slop reports combined with a lower quality even in the reports that were not obvious slop – presumably because they too were actually misled by AI but with that fact just hidden better.
Maybe the first five years made it possible for researchers to find and report the low hanging fruit. Previous years we have had a rate of somewhere north of 15% of the submissions ending up confirmed vulnerabilities. Starting 2025, the confirmed-rate plummeted to below 5%. Not even one in twenty was _real_.
The never-ending slop submissions take a serious mental toll to manage and sometimes also a long time to debunk. Time and energy that is completely wasted while also hampering our will to live.
I have also started to get the feeling that a lot of the security reporters submit reports with a _bad faith attitude._ These “helpers” try too hard to twist whatever they find into something horribly bad and a critical vulnerability, but they rarely actively contribute to actually _improve_ curl. They can go to extreme efforts to argue and insist on their specific current finding, but not to write a fix or work with the team on improving curl long-term etc. I don’t think we need more of that.
There are these three bad trends combined that makes us take this step: the mind-numbing AI slop, humans doing worse than ever and the apparent will to poke holes rather than to help.
## Actions
In an attempt to do something about the sorry state of curl security reports, this is what we do:
* We no longer offer any monetary rewards for security reports – no matter which severity. In an attempt to remove the incentives for submitting made up lies.
* We stop using Hackerone as the recommended channel to report security problems. To make the change immediately obvious and because without a bug-bounty program we don’t need it.
* We refer everyone to submit suspected curl security problems on GitHub using their _Private vulnerability reporting_ feature.
* We continue to immediately _ban and publicly_ _ridicule_ everyone who submits AI slop to the project.
## Maintain curl security
We believe that we can maintain and continue to evolve curl security in spite of this change. Maybe even improve thanks to this, as hopefully this step helps prevent more people pouring sand into the machine. Ideally we reduce the amount of wasted time and effort.
I believe the best and our most valued security reporters still will tell us when they find security vulnerabilities.
## Instead
If you suspect a security problem in curl going forward, we advise you to head over to GitHub and submit them there.
Alternatively, you send an email with the full report to `security @ curl.se`.
In both cases, the report is received and handled privately by the curl security team. But with _no monetary reward offered_.
## Leaving Hackerone
Hackerone was good to us and they have graciously allowed us to run our program on their platform for free for many years. We thank them for that service.
As we now drop the rewards, we feel it makes a clear cut and displays a clearer message to everyone involved by also moving away from Hackerone as a platform for vulnerability reporting. It makes the change more visible.
## Future disclosures
It is probably going to be harder for us to publicly disclose every incoming security report in the same way we have done it on Hackerone for the last year. We need to work out something to make sure that we can keep doing it at least imperfectly, because I believe in the goodness of such transparency.
## We stay on GitHub
Let me emphasize that this change does not impact our presence and mode of operation with the curl repository and its hosting on GitHub. We hear about projects having problems with low-quality AI slop submissions on GitHub as well, in the form of issues and pull-requests, but for curl we have not (yet) seen this – and frankly I don’t think switching to a GitHub alternative saves us from that.
## Other projects do better
Compared to others, we seem to be affected by the sloppy security reports to a higher degree than the average Open Source project.
With the help of Hackerone, we got numbers of how the curl bug-bounty has compared with other programs over the last year. It turns out curl’s program has seen more volume and noise than other public open source bug bounty programs in the same cohort. Over the past four quarters, curl’s inbound report volume has risen sharply, while other bounty-paying open source programs in the cohort, such as Ruby, Node, and Rails, have not seen a meaningful increase and have remained mostly flat or declined slightly. In the chart, the pink line represents curl’s report volume, and the gray line reflects the broader cohort.
Inbound Report Volume on Hackerone: curl compared to OSS peers
We suspect the idea of getting money for it is a big part of the explanation. It brings in real reports, but makes it too easy to be annoying with little to no penalty to the user. The reputation system and available program settings were not sufficient for us to prevent sand from getting into the machine.
The exact reason why we suffer more of this abuse than others remains a subject for further speculation and research.
## If the volume keeps up
There is a non-zero risk that our guesses are wrong and that the volume and security report frequency will keep up even after these changes go into effect.
If that happens, we will deal with it then and take further appropriate steps. I prefer not to overdo things or _overplan_ already now for something that ideally does not happen.
## We won’t charge
People keep suggesting that one way to deal with the report tsunami is to _charge_ security researchers a small amount of money for the privilege of submitting a vulnerability report to us. A _curl reporters security club_ with an entrance fee.
I think that is a less good solution than just dropping the bounty. Some of the reasons include:
* Charging people money in an International context is complicated and a maintenance burden.
* Dealing with charge-backs, returns and other complaints and friction add work.
* It would limit who could or would submit issues. Even some who actually find legitimate issues.
Maybe we need to do this later anyway, but we stay away from it for now.
## Pull requests are less of a problem
We have seen other projects and repositories see similar AI-induced problems for pull requests, but this has not been a problem for the curl project. I believe for PRs we have better much means to sort out the weed with automatic means, since we have tools, tests and scanners to verify such contributions. We don’t need to waste any human time on pull requests until the quality is good enough to get green check-marks from 200 CI jobs.
## Related
I will do a talk at FOSDEM 2026 titled Open Source Security in spite of AI that of course will touch on this subject.
## Future
We never say never. This is now and we might have reasons to reconsider and make a different decision in the future. If we do, we will let you know. These changes are applied now with the hope that they will have a positive effect for the project and its maintainers. If that turns out to not be the outcome, we will of course continue and apply further changes later.
## Media
Since I created the pull request for updating the bug-bounty information for curl on January 14, almost two weeks before we merged it, various media picked up the news and published articles. Long before I posted this blog post.
* The Register: Curl shutters bug bounty program to remove incentive for submitting AI slop
* Elektroniktidningen: cURL removes bug bounties
* Heise online: curl: Projekt beendet Bug-Bounty-Programm
* Neowin: Beloved tool, cURL is shutting down its bug bounty over AI slop reports
* Golem: Curl-Entwickler dreht dem “KI-Schrott” den Geldhahn zu
* Linux Easy: cURL chiude il programma bug bounty: troppi report generati dall’AI
* Bleeping Computer: Curl ending bug bounty program after flood of AI slop reports
* The New Stack: Drowning in AI slop, cURL ends bug bounties
* Ars Technica: Overrun with AI slop, cURL scraps bug bounties to ensure “intact mental health”
* PressMind Labs: cURL ko?czy program bug bounty – czy to koniec jako?ci zg?osze??
* Socket: curl Shuts Down Bug Bounty Program After Flood of AI Slop Reports
Also discussed (indirectly) on Hacker News.
The end of the #curl bug-bounty
https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/
26.01.2026 07:25
👍 65
🔁 80
💬 5
📌 4
"Think not of the books you've bought as a 'to be read' pile. Instead, think of your bookcase as a wine cellar. You collect books to be read at the right time, the right place, and the right mood." --Luc van Donkersgoed
This!
22.01.2026 18:23
👍 2
🔁 2
💬 0
📌 0
Danish Parliament Deputy Speaker Lars-Christian Brask:
"If I could come with some advice, it would be for the Senate & House to start to take control of political power in America because with this erratic & mad behaviour, you have to ask the question, is the President capable of running the US?"
19.01.2026 16:50
👍 35000
🔁 12039
💬 1720
📌 1394
Three coffins wrapped in Danish flags are carried by 4-6 soldiers each; a cargo aircraft is in the background
I think a good strategy for your non-leftist social media presence (ie everywhere but here) is to give this photo - the remains of Danish soldiers returning in coffins after being killed in America's war in Afghanistan - as wide an audience as possible. Remind people who we're betraying
19.01.2026 16:32
👍 2444
🔁 1162
💬 37
📌 51
It's not news that extreme warming can compromise the carbon storage in plants. What is news to me is that we are so close to the trigger for this. This paper talks about 1,000 PPM CO2 concentration. We're currently at around 430 which represents an increase of 150 versus a few decades ago.
14.01.2026 00:13
👍 2
🔁 1
💬 0
📌 0
Generated by Make it a Quote
User: mhundhausen.bsky.social
Content: Wer glaubt, dass sich geopolitische Krisen lösen lassen, indem wir weiter unser Land mit fossilen und nuklearen Brennstoffen betreiben?
Jeder, der weiter auf Öl und Gas setzt, finanziert diese Krisen.
Ich will jetzt nicht hören, dass Windenergieanlagen häßlich und Dämmung unbezahlbar sind.
03.01.2026 18:07
👍 33
🔁 10
💬 0
📌 0
Nice hair style :-)
13.01.2026 22:55
👍 0
🔁 0
💬 0
📌 0
Uruguay’s Renewable Charge: A Small Nation, A Big Lesson For The World
Uruguay built a power grid that runs 99% on renewables—at half the cost of fossil fuels. Here’s how its bold energy overhaul became a global model.
“Uruguay did what most nations still call impossible: it built a power grid that runs almost entirely on renewables—at half the cost of fossil fuels. The physicist who led that transformation says the same playbook could work anywhere—if governments have the courage to change the rules.”
10.01.2026 08:29
👍 11021
🔁 4508
💬 203
📌 342
![Comic. [Instructions on package] High Altitude Cooking Instructions: 3,500-6,500 ft: Add ½ cup water, increase cook time to 12 minutes. 6,500-9,500 ft: Add ¼ cups water, increase cook time to 18 minutes. 250,000-450,000 ft: Orient reentry vehicle for aerodynamic stability. Deploy parachutes at 10,000 ft. Descend, keeping crew capsule tightly covered, for 3-4 minutes. After splashdown, follow sea level cooking instructions.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:cz73r7iyiqn26upot4jtjdhk/bafkreibv5te47jncpebx4vihxhudiyzveoxffo5234lpanhsp2aq3lrb5a@jpeg)
Comic. [Instructions on package] High Altitude Cooking Instructions: 3,500-6,500 ft: Add ½ cup water, increase cook time to 12 minutes. 6,500-9,500 ft: Add ¼ cups water, increase cook time to 18 minutes. 250,000-450,000 ft: Orient reentry vehicle for aerodynamic stability. Deploy parachutes at 10,000 ft. Descend, keeping crew capsule tightly covered, for 3-4 minutes. After splashdown, follow sea level cooking instructions.
High Altitude Cooking Instructions
xkcd.com/3187/
31.12.2025 20:17
👍 2734
🔁 318
💬 15
📌 9
Happy holidays Chris!
20.12.2025 06:39
👍 1
🔁 0
💬 0
📌 0
Schweiz: Palantir-Software hat verheerende Risiken
Nach Risikoprüfung des Einsatzes von Palantir-Software in der Schweiz bekam der US-Konzern eine Absage, trotz jahrelanger Hofierung von Behörden und Armee. Den Eidgenossen sind die Risiken zu groß. Da...
"Die Analyse enthält auch einen 20-seitigen internen Evaluationsbericht der Armee (...) Die Militärexperten kommen zu dem Schluss, dass ein Abfluss von Daten aus den #Palantir Systemen technisch nicht verhindert werden könne." #Schweiz 🇨🇭
09.12.2025 02:04
👍 509
🔁 229
💬 13
📌 9
AI tools are 'deskilling' workers, philosophy professor says
A philosophy professor warns that AI reliance is weakening workers' judgment, creativity, and problem-solving.
We can't really say this enough...
> Anastasia Berg [at UCL Irvine] said that new research — and what she's hearing directly from colleagues across various industries — shows that employees who heavily rely on AI are losing core skills at a startling rate.
www.businessinsider.com/ai-tools-are...
30.11.2025 18:09
👍 982
🔁 444
💬 19
📌 78
Market share of battery electric heavy trucks reaches ~20% in China. Modified versions could become attractive in European markets too, starting with short-haul trucks.
30.11.2025 09:28
👍 42
🔁 21
💬 2
📌 0
Worth reading for thoughts on the bubble and this (in image with alt-text) on how LLMs are the wrong model for general AI. You need something that builds a model of the world not just correlations among words.
01.12.2025 15:46
👍 4
🔁 3
💬 1
📌 0
The full agenda of the meetup from 5 PM, thursday 27th in Stuttgart university, room V47 4.282.
- Welcome & Introduction
- Everything to the Web? with Heiko Klare - Vector Informatik
- Eclipse RCP in train transportation with Gilles Iachelini - MTrail
- AI “Agent Client Protocol” in Eclipse with Joel Johansson - Deltek
- Technical challenges in Eclipse IDE with Sebastian Ratz - SAP
- The Java diagnostic tools with Tobias Frech - JUG Stuttgart
- BoF - Open Discussion
🇩🇪 Near Stuttgart? This free meetup looks spot on: real world #EclipsePlatform, #RCP, #EclipseIDE, and #Java stories plus forward looking topics, ending with an open BoF. 🍻
⏳ Register: eventbrite.com/e/eclipse-id...
👉 Newcomers welcome!
24.11.2025 11:53
👍 3
🔁 3
💬 0
📌 0
The Eclipse Foundation is shaping the future of open source AI, and you can be a part of it.
Join our growing AI community! Sign up for email updates and get news, projects, & events straight to your inbox.
📩 eclipse.org/ai
21.11.2025 12:11
👍 0
🔁 1
💬 0
📌 0
Stack of blocks labeled, all modern digital infrastructure. A ratchet tipping over the entire stack is labeled AI. A load bearing pillar is labeled unpaid open source development. Another label is AWS, and Cloudflare and Unpaid Open Source Developers.
Extremely upset that a throw-away XKCD joke somehow became the organizing principle for the Internet.
20.11.2025 02:31
👍 2816
🔁 860
💬 34
📌 27
Fake book cover: Disabling Microsoft Copilot
I am writing a book
17.11.2025 14:19
👍 181
🔁 38
💬 0
📌 0
Gerrit Meetup in Munich is about to start #gerritcodereview
19.11.2025 17:47
👍 0
🔁 0
💬 0
📌 0
