The AI-Induced Death of A Bug Bounty Program with Glauber Costa

The Business of Open Source is back! I’m starting a series about AI and open source this week. 

I reached out to Glauber Costa, founder of Turso, after reading a post of his on LinkedIn about how bot-written PRs for their bug bounty program forced them to discontinue the program completely. In this episode, he talked about the bug bounty program — how it started, who contributed to it initially, why he considered it a huge success. And then he talks about what started happening when bots entered the picture. 

He also talked about the difference between an open source project that accepts contributions and one that doesn’t, about the difference between an open source project and software that’s in the public domain, and how people in open source used to be seen as weirdos who hate money. 

Glauber isn’t an AI hater — he talks about how they use AI at Turso, and how he has no problem with AI-assisted pull requests. The issue is when the result isn’t high-quality. There's also a difference between AI-assisted and 100% bot written. Then it creates essentially a denial of service attack on the community, because the maintainers end up having to spend so much time responding to bot-created PRs. 

What’s your experience with AI and Open Source? Who else should I talk to? Let me know. 

Do you like The Business of Open Source? Help it to continue to exist by sponsoring the podcast.

Does your company have a positioning problem? Work with me to better position your product and see your growth take off.