Matt Brown

@mattbrowndev
413 Followers
387 Following
78 Posts
I write developer tooling at Slack. I used to work at Vimeo, where I made @psalm
LocationBrooklyn NY
Webhttps://mattbrown.dev
Show threadMatt Brown4d ago

@sarah @pollita Here's Daniel's initial blog post on the matter: https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/

In the hands of experts, proprietary LLM-assisted security analysis caught 50 bugs/vulnerabilities in Curl: https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/

But commercially-available LLMs make it easy for clueless grifters to submit HackerOne reports, so they had to shut down the whole thing.

The end of the curl bug-bounty

tldr: an attempt to reduce the terror reporting. There is no longer a curl bug-bounty program. It officially stops on January 31, 2026. After having had a few half-baked previous takes, in April 2019 we kicked off the first real curl bug-bounty with the help of Hackerone, and while it stumbled a bit at first … Continue reading The end of the curl bug-bounty →

daniel.haxx.se
Show threadMatt Brown4d ago
@OndrejMirtes I’ve found LLMs work well in highly-tested and testable systems, which defines static analysis tools well
Show threadMatt Brown4d ago
This is where LLMs have been most useful at work: making projects that required a lot of boring manual labour suddenly viable
Matt Brown4d ago

I created two PHP sites in 2011 that are still going, 15 years later. Code that got the job done but was terribly-written. Yesterday I spent a couple of hours with Claude, which modernised the code and eliminated a few egregious vulnerabilities. Some things broke in the migration and optimisation, but they were easy to fix.

It wasn’t worth my time to do this work myself, and paves the way to move a bunch of sites (including psalm.dev) off a $1,000/year server to something much cheaper.

Show threadMatt BrownJan 31
@ocramius that’s a solid amount of daily running. More than I do. You could try some speed workouts? And maybe explore different streets. But what you have now is great. No need to go crazy.
Show threadMatt BrownDec 22
@Arkenston @sebastian this is AI — you can tell because there are literally no other trees around, or anything else for that matter
Show threadMatt BrownDec 14
@wilfredh I would be impressed if you could turn that into something exploitable though
Show threadMatt BrownDec 14
@wilfredh but it’s just cargo test in that same repo — not any invocation to cargo test anywhere
Show threadMatt BrownNov 28
@Girgias basically magic methods and references, right? And also (maybe) array autovivification? References are so totally awful to reason about that most static analysis tools don’t bother (beyond function arguments).
Show threadMatt BrownNov 21
@katienotopoulos if Threads made it easier to extract metadata from a post then Slack could support richer unfurls like we do for Bluesky (move to Bluesky). But alas.