Don't Insert Crazy! On cURL and AI Slop

Join this 48-minute conference talk where Daniel Stenberg, creator of cURL, discusses the critical decision to shut down cURL's bug bounty program due to an overwhelming flood of AI-generated false vulnerability reports. Learn how artificial intelligence is disrupting open source security workflows by creating massive amounts of noise that drowns out legitimate security research, forcing maintainers to spend countless hours filtering through automated submissions that aren't real issues. Discover the impact this shift is having on the open source ecosystem, from funding challenges to community dynamics, as Stenberg explains how cURL will transition to GitHub-based reporting and what this means for the future of vulnerability disclosure. Explore broader topics including cURL's massive impact on internet infrastructure, the evolution of web protocols, security concerns in open source projects, and valuable lessons learned from maintaining one of the world's most widely-used software libraries. Gain insights into the challenges facing open source maintainers in an era where AI-generated content is increasingly difficult to distinguish from human contributions, and understand the implications for researchers, contributors, and the sustainability of community-driven security efforts.