r/netsec • u/unknownhad • 1d ago

All vulnerabilities are now race conditions

https://blog.himanshuanand.com/2026/09/all-vulnerabilities-are-now-race-conditions/
49 Upvotes

75% Upvoted

15 comments sorted by

30

u/nicholashairs 1d ago

I absolutely hate the title because I just know it's going to be misquoted. However despite me opening the article out of spite to see what it was actually about (it was obviously a bait):

This is actually well worth a read. It's essentially a dive into the economics and implications of the current bug bounty market. Some of it is AI driven, but not all of it is.

24

u/_predator_ 1d ago

I tried but the Claude-isms drive me insane, "since we are being honest".

23

u/Funktapus 1d ago

Tldr has back to back “it’s not X it’s Y”s. Getting to nails-on-chalkboard status with me

9

u/UnacceptableUse 1d ago

It's really ruining reading anything online for me

3

u/MelangeBot 11h ago

Yeah it's not annoying, it's infuriating!

3

u/best_of_badgers 1d ago

The X nobody Y.

1

u/awkisopen 22h ago

The random table reiterating what the previous paragraph said with no new information is where I stopped.

1

u/nicholashairs 1d ago

Yeah they bugged me too

-9

u/unknownhad 1d ago

Author here :
>I absolutely hate the title because I just know it's going to be misquoted. 
Indeed it was a bait and I am glad it worked.
I can change it, but most of my posts get un seen so this time I am trying to spice it up a little.
At the end of the day community will decide what they want to read, will write accordingly.
Thanks for reading and your feedback. 🙌

3

u/nicholashairs 1d ago

Yeah it is a legitimate strategy

1

u/McDutchie 1d ago

Your title is an absolute lie, so I won't even bother opening the article.

3

u/pihkal 21h ago

Nice article! I especially like the reframing: "A bug bounty is better understood as a marketplace for behaviour than a marketplace for information."

Bit of a minor note, it's mixing vulnerability quality over time with vulnerability volume in its timeline. I feel it would be better to focus on one, or more clearly distinguish between the two in their effects on bug bounties.

Stenberg shut down the curl bounty not just because of being overwhelmed, but because the quality was too low. But only a few months later, Stenberg also said that incoming reports were now actually high-quality. Based on the time frame Apache looked at, I'll bet the same was true for them.

That being said, I 100% believe the overall story. A firehose is still a firehose, even if the water was muddy for awhile.

3

u/sudomatrix 7h ago edited 7h ago

The meaning of the article is interesting and useful to think about. But you'll have to wade through garbage like this: "That distinction carries the whole article, so sit with it for a second."

At this point it's just lazy to not add "Here is a sample of my own writing. Use this as a reference for your writing style." to the prompt.

1

u/coffeeicefox 5h ago

That’s not what race condition means…

1

u/just_a_Suggesture 5h ago

"someone on a salary will lose an afternoon proving it was fiction, and enough of those afternoons is how curl’s programme died"

What are great way to put the value of someone's time into words.

What a shame I have to sit here and wonder if it's his words or glorified auto correct. Is this the future? Even interesting articles with well put points are now the domain of text prediction?