What's this about?
Daniel Stenberg, curl's maintainer, writes up a disputed CVE filed against his project. The HN thread turns into an argument about what a CVE is worth now that anyone can point a model at a codebase and file whatever comes out.
What is a CVE and why would someone want one?
A Common Vulnerabilities and Exposures identifier is a public catalogue entry for a security flaw, with a number that becomes the permanent reference. Having your name attached to one against a major project has long been informal proof that you can do the work — the joke that you aren't a real hacker until you have one is only half a joke. That reputational value is exactly what creates the incentive problem when the cost of generating a plausible-looking report drops to nearly zero.
What's the community saying?
HN 184 points, 44 comments
- The incentive analysis is the thread's core: a curl CVE has cachet you can convert into a raise or a job, so money was always part of it — and now people throw code at an LLM and paste the output into a report.
- A dissent: unless it is critical, a CVE is worth very little for a career now, in the same way small OSS contributions have been devalued.
- The rebuttal that holds: until it becomes normal to verify a CVE's quality, it still functions as public recognition, and hiring processes do not verify.
- Non-cynical readings appear too — one commenter suggests the false promise of open source (that someone else read the code) may finally come true, because an LLM will have read it.
- And several structural explanations for the volume: prediction-market bets, and employer pressure in places where security teams are measured on CVE counts.