Hacker News Reader

Comment by abirch | Hacker News Reader

AI can be the ultimate tactical tornado.

Yup, this was my first thought. Tell an LLM that there's a bug, and it will _happily_ add 200 lines to the project, usually wrapped in if statements so that it all interleaves with existing code. Then it will write twice as many lines in tests, run it all, and be done. Your bug is fixed. All the tests run, and test coverage went up. Now do that a couple dozen more times. :shudder:

But it really doesn't have to be like this.

For their bug bounty program, the company can just charge 5-10$ per submission to guarantee everything you send gets thoroughly reviewed by a human, and so it completely eliminates bot slop DDoS submissions overnight. If your bug and PR was actually good, then you get 10 + 1000$ back, and if it wasn't good, then you need to do better due diligence next time, and the skilled human feedback you received on why it wasn't good, was a valuable lesson for your engineering career, and it only cost you the price of a Starbucks latte, and it also cut out all the scammers polluting the system. This way everyone wins.

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is THE ONLY (anonymous) WAY to filter out serious people from bad actors doing spray-and-pray hoping they'll make some money, or get that job, by weaponizing AI bots. You can't rely on honor systems and a high trust society on the anonymous open internet, you need to financially gatekeep to save yourself and your sanity, and make sure the honest serious people you want to engage with don't end up drowning in the noise of the scammers and unscrupulous opportunists.

But we can't shut ourselves down just because we refuse to apply solutions to AI slop DDoS.

The bots spam even when there's no bug bounty program. The emails start out with "I received $500 for a similar reported on another site"

Thankfully the number of beg bounties I've seen has been stable so far. Maybe they're just devoting most of their time on the places that openly promise money.

This is a great strategy idea, I like it. I'm not good at thinking out the curse of the monkey's paw, so I'm curious if folks can think of any downsides.

I said it before and I'll say it again, for opportunities open to the entire world on the internet, adding monetary friction is the only way to filter out serious people from bad actors doing spray-and-pray hoping they make some money or get that job through weaponizing AI bots and sucking all the air in the room.

So many problems can be solved that way, including customer support. Instead of having to post a sob story on Twitter and HN when the AI at BigCo bans my account for no reason, why not charge me $100 for access to human support that is empowered to triage and escalate genuine issues? Then, issue a refund if the problem is on their end.

I don't understand why this isn't a thing.

I wonder if transaction costs get in the way. Someone has to pay the payment provider in both directions.

$100 is way too much. Maybe $5 to get people to spend 30 seconds on google to solve the easy problems instead of calling. But I wonder if even that would be enough to significantly incentivize claiming everything is intended behavior / user error just for another revenue stream.

My guess is there is no easy way to deal with chargebacks and they would probably be bad.

It would almost need to be analog. Fill out this form and drop it in the mail with 10 bucks inside.

Placing holds on money on a credit card is totally normal. Hotels do that all the time.

My guess is there is no easy way to deal with chargebacks and they would probably be bad.

Sure there is. That would be casus belli for a real ban.

It’s hard to forecast this. Support calls occur chaotically. So staffing to support them is difficult to do in a way that keeps a steady margin.

Then who arbitrates the inevitable dispute over whose end the problem was?

For the times when it actually saves the company from going through arbitration, $100 is cheap.

$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary.

You could probably adjust the cost per region, but then you open yourself up to spam bots again because it’s trivial to spoof one’s location.

>$100 for someone in SV isn’t much. $100 USD for someone in Africa, India, some parts of Asia could be a week or even months salary.

That's kinda irrelevant. A Macbook Pro is still around $2k USD whether you're in US, EU, LATAM, Africa or India. They don't sell it cheaper to people in developing nations just because they earn less money.

You do know that there are ways online without a MBP?

And that developing countries do have access to the internet too.

That's offtopic form what I was replying to.

Then that would make your comment off topic from what everyone else was talking about.

  > monetary friction is THE ONLY (anonymous) WAY to filter out serious people from bad actors

How are monetary transactions anonymous?

It's not fully anonymous but partly.

Reply on news.ycombinator.com