Duncan Brown

Duncan Brown

@duncanjbrown.com

I make software. i.AI, NHS, DfE https://mechanicalsurvival.com

346 followers462 following90 posts

Duncan Brown
@duncanjbrown.com

so they are "decoherent", which means that when you put them in previously coherent systems they tend to eat away at them because they cannot optimise against reality, only comfortable proxies, so complexity must be very actively governed. this feels right?

Duncan Brown
@duncanjbrown.com

of course i find that little pockets of decoherence (tiny LLM apps i will use and throw away) are useful and fun. i guess they are not systems that need to weather changes, though, and _that_ is the quality requiring coherence? this language is new to me, i like it.

Duncan Brown
@duncanjbrown.com

argument something like: optimisation on a large scale is hard but keeps things coherent; optimisation in pockets is easy but gets very expensively incoherent; LLMs are well suited to optimising for closed systems like games & code, but only insofar as these are sealed off from the Real World

Duncan Brown
@duncanjbrown.com

I guess any code hosting platform could now dramatically grow its user base and code portfolio by offering free AI security scans for open source software.

Duncan Brown
@duncanjbrown.com

It’s frustrating when reports like this cite the “highly interoperable nature” of commercial software as a given. Interoperability doesn’t mean “everything in one place”—it means the opposite. But redefining it allows vendors to present a magical solution.

The Guardian@theguardian.com

Palantir’s NHS England contract ‘opens door to government abuse of power’, health bosses told

theguardian.comPalantir’s NHS England contract ‘opens door to government abuse of power’, health bosses toldHealth justice charity Medact says data-sharing potential could be used for UK version of US immigration raids Palantir’s NHS contract opens the door to the Big Brother-style data-sharing that Reform UK would use for a version of US immigration raids, health bosses have been told. Palantir Technologies – the data analytics company founded by Peter Thiel and Alex Karp – won a £330m NHS England contract to deliver the Federated Data Platform in 2023. Continue reading...
Duncan Brown
@duncanjbrown.com

corollary: if you run an open source library with any users at all, you are now in a vulnerability-finding arms race with those who will mechanically find and exploit security issues in your code… and embarrassingly, any software that depends on it

Rollofthedice@hotrollhottakes.bsky.social

this is wild lol

Duncan Brown
@duncanjbrown.com

“We continue to immediately ban and publicly ridicule everyone who submits AI slop to the project.”

daniel:// stenberg://@bagder.mastodon.social.ap.brid.gy

The end of the #curl bug-bounty https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/

daniel.haxx.seThe end of the curl bug-bountytldr: an attempt to reduce the _terror reporting_. **There is no longer a curl bug-bounty program.** It officially stops on January 31, 2026. After having had a few half-baked previous takes, in April 2019 we kicked off the first real curl bug-bounty with the help of Hackerone, and while it stumbled a bit at first it has been quite successful I think. We attracted skilled researchers who reported plenty of actual vulnerabilities for which we paid fine monetary rewards. We have certainly made curl better as a direct result of this: **87 confirmed vulnerabilities and over 100,000 USD** paid as rewards to researchers. I’m quite happy and proud of this accomplishment. I would like to especially highlight the awesome Internet Bug Bounty project, which has paid the bounties for us for many years. We could not have done this without them. Also of course Hackerone, who has graciously hosted us and been our partner through these years. Thanks! ## How we got here Looking back, I think we can say that the downfall of the bug-bounty program started slowly in the second half of 2024 but accelerated badly in 2025. We saw an explosion in AI slop reports combined with a lower quality even in the reports that were not obvious slop – presumably because they too were actually misled by AI but with that fact just hidden better. Maybe the first five years made it possible for researchers to find and report the low hanging fruit. Previous years we have had a rate of somewhere north of 15% of the submissions ending up confirmed vulnerabilities. Starting 2025, the confirmed-rate plummeted to below 5%. Not even one in twenty was _real_. The never-ending slop submissions take a serious mental toll to manage and sometimes also a long time to debunk. Time and energy that is completely wasted while also hampering our will to live. I have also started to get the feeling that a lot of the security reporters submit reports with a _bad faith attitude._ These “helpers” try too hard to twist whatever they find into something horribly bad and a critical vulnerability, but they rarely actively contribute to actually _improve_ curl. They can go to extreme efforts to argue and insist on their specific current finding, but not to write a fix or work with the team on improving curl long-term etc. I don’t think we need more of that. There are these three bad trends combined that makes us take this step: the mind-numbing AI slop, humans doing worse than ever and the apparent will to poke holes rather than to help. ## Actions In an attempt to do something about the sorry state of curl security reports, this is what we do: * We no longer offer any monetary rewards for security reports – no matter which severity. In an attempt to remove the incentives for submitting made up lies. * We stop using Hackerone as the recommended channel to report security problems. To make the change immediately obvious and because without a bug-bounty program we don’t need it. * We refer everyone to submit suspected curl security problems on GitHub using their _Private vulnerability reporting_ feature. * We continue to immediately _ban and publicly_ _ridicule_ everyone who submits AI slop to the project. ## Maintain curl security We believe that we can maintain and continue to evolve curl security in spite of this change. Maybe even improve thanks to this, as hopefully this step helps prevent more people pouring sand into the machine. Ideally we reduce the amount of wasted time and effort. I believe the best and our most valued security reporters still will tell us when they find security vulnerabilities. ## Instead If you suspect a security problem in curl going forward, we advise you to head over to GitHub and submit them there. Alternatively, you send an email with the full report to `security @ curl.se`. In both cases, the report is received and handled privately by the curl security team. But with _no monetary reward offered_. ## Leaving Hackerone Hackerone was good to us and they have graciously allowed us to run our program on their platform for free for many years. We thank them for that service. As we now drop the rewards, we feel it makes a clear cut and displays a clearer message to everyone involved by also moving away from Hackerone as a platform for vulnerability reporting. It makes the change more visible. ## Future disclosures It is probably going to be harder for us to publicly disclose every incoming security report in the same way we have done it on Hackerone for the last year. We need to work out something to make sure that we can keep doing it at least imperfectly, because I believe in the goodness of such transparency. ## We stay on GitHub Let me emphasize that this change does not impact our presence and mode of operation with the curl repository and its hosting on GitHub. We hear about projects having problems with low-quality AI slop submissions on GitHub as well, in the form of issues and pull-requests, but for curl we have not (yet) seen this – and frankly I don’t think switching to a GitHub alternative saves us from that. ## Other projects do better Compared to others, we seem to be affected by the sloppy security reports to a higher degree than the average Open Source project. With the help of Hackerone, we got numbers of how the curl bug-bounty has compared with other programs over the last year. It turns out curl’s program has seen more volume and noise than other public open source bug bounty programs in the same cohort. Over the past four quarters, curl’s inbound report volume has risen sharply, while other bounty-paying open source programs in the cohort, such as Ruby, Node, and Rails, have not seen a meaningful increase and have remained mostly flat or declined slightly. In the chart, the pink line represents curl’s report volume, and the gray line reflects the broader cohort. Inbound Report Volume on Hackerone: curl compared to OSS peers We suspect the idea of getting money for it is a big part of the explanation. It brings in real reports, but makes it too easy to be annoying with little to no penalty to the user. The reputation system and available program settings were not sufficient for us to prevent sand from getting into the machine. The exact reason why we suffer more of this abuse than others remains a subject for further speculation and research. ## If the volume keeps up There is a non-zero risk that our guesses are wrong and that the volume and security report frequency will keep up even after these changes go into effect. If that happens, we will deal with it then and take further appropriate steps. I prefer not to overdo things or _overplan_ already now for something that ideally does not happen. ## We won’t charge People keep suggesting that one way to deal with the report tsunami is to _charge_ security researchers a small amount of money for the privilege of submitting a vulnerability report to us. A _curl reporters security club_ with an entrance fee. I think that is a less good solution than just dropping the bounty. Some of the reasons include: * Charging people money in an International context is complicated and a maintenance burden. * Dealing with charge-backs, returns and other complaints and friction add work. * It would limit who could or would submit issues. Even some who actually find legitimate issues. Maybe we need to do this later anyway, but we stay away from it for now. ## Pull requests are less of a problem We have seen other projects and repositories see similar AI-induced problems for pull requests, but this has not been a problem for the curl project. I believe for PRs we have better much means to sort out the weed with automatic means, since we have tools, tests and scanners to verify such contributions. We don’t need to waste any human time on pull requests until the quality is good enough to get green check-marks from 200 CI jobs. ## Related I will do a talk at FOSDEM 2026 titled Open Source Security in spite of AI that of course will touch on this subject. ## Future We never say never. This is now and we might have reasons to reconsider and make a different decision in the future. If we do, we will let you know. These changes are applied now with the hope that they will have a positive effect for the project and its maintainers. If that turns out to not be the outcome, we will of course continue and apply further changes later. ## Media Since I created the pull request for updating the bug-bounty information for curl on January 14, almost two weeks before we merged it, various media picked up the news and published articles. Long before I posted this blog post. * The Register: Curl shutters bug bounty program to remove incentive for submitting AI slop * Elektroniktidningen: cURL removes bug bounties * Heise online: curl: Projekt beendet Bug-Bounty-Programm * Neowin: Beloved tool, cURL is shutting down its bug bounty over AI slop reports * Golem: Curl-Entwickler dreht dem “KI-Schrott” den Geldhahn zu * Linux Easy: cURL chiude il programma bug bounty: troppi report generati dall’AI * Bleeping Computer: Curl ending bug bounty program after flood of AI slop reports * The New Stack: Drowning in AI slop, cURL ends bug bounties * Ars Technica: Overrun with AI slop, cURL scraps bug bounties to ensure “intact mental health” * PressMind Labs: cURL ko?czy program bug bounty – czy to koniec jako?ci zg?osze?? * Socket: curl Shuts Down Bug Bounty Program After Flood of AI Slop Reports Also discussed (indirectly) on Hacker News.
Duncan Brown
@duncanjbrown.com

My sense is that the Test and Learn movement in the public sector anchors much more on “build-and-test” than “describe-and-defend” as this essay sets them out… possibly to its detriment?

Manoel Horta Ribeiro@manoelhortaribeiro.bsky.social

In a new blog post, I contrast two flavors of empiricism: the one practiced in the social sciences and the one practiced in ML/CS. I argue that we need both, given that CS is increasingly about "claims," and not just constructing artifacts. doomscrollingbabel.manoel.xyz/p/the-empiri...

Duncan Brown
@duncanjbrown.com

Whereas a module that Palantir chooses to extract and add to their platform is just proprietary software. It's clever: they've harnessed the network effects of a open-source like ecosystem with a completely closed commercial model. Good business! And walled gardens surely have advantages.

Duncan Brown
@duncanjbrown.com

I think the real lesson to draw from Palantir's many contracts is that government has on the whole so successfully driven away talent that those who show up capable and incentivised to engage with the real problems seem like manna from heaven—& worth the ££££ and the lock-in. We should look to that!

Duncan Brown
@duncanjbrown.com

These are imperfect means to capture "solutions". But there's an irreducible difference between being solving one problem and having a generic solution to more than one—indeed the latter makes for the bad old consultancy model ZS contrasts unfavourably with Palantir's.

Duncan Brown
@duncanjbrown.com

ZS observes that for "indie consultants" "there’s no one extracting the patterns. The knowledge compounds in their heads... but it doesn’t get productised. It doesn’t create leverage." We do have that though: open source, the design system, the service manual.

Duncan Brown reposted

Bozhidar Batsov (a.k.a. Bug)
@batsov.net

One of the many joys of using AI for programming is the creation of huge PRs on complex topics that the authors barely understand, but still suggest "because they work". Here's a great example from #OCaml github.com/ocaml/ocaml/... Kudos to OCaml's maintainers for handling this so gracefully.

github.comDWARF support for macOS and Linux by joelreymont · Pull Request #14369 · ocaml/ocamlDWARF v5 Debugging Support for OCaml Native Compiler This PR adds DWARF v5 debug information to the OCaml native compiler, allowing proper source-level debugging in GDB and LLDB. What's Impleme...
Duncan Brown
@duncanjbrown.com

This really resonates. Meetings are the synchronisation penalty public servants pay for an overwhelmingly synchronous, distributed system of management. The “meeting culture” is not optional—it expresses a cultural void where autonomy can’t flourish.

Rachel Coldicutt@rachelcoldicutt.bsky.social

Sthg I don't specifically call out in this blog post on AI notetakers is how awful some bits of govt meeting culture appear to be. The bit about presenteeism directly reflects feedback from junior folk who talked about how important it is to turn up to meetings www.careful.industries/blog/2025-11...

careful.industriesNine risks caused by AI notetakers — Careful IndustriesAI transcription tools are not currently mature or reliable enough to be regarded as an always on, single-source of truth for meeting notes. Nine common risks, and six possible mitigations.
Duncan Brown
@duncanjbrown.com

A few ideas on what "good software" (not "good code"!) is, touching ethics, interop, commercials and functionality 🧵

Charity Majors@charity.wtf

for context: the second edition of "Observability Engineering" starts off swinging with an opinionated chapter called "The Fundamentals of Building Good Software". which begs the question... what IS ✨ good software ✨? i'll drop my answers 👇 but curious to hear others.

View full thread
Duncan Brown
@duncanjbrown.com

A few ideas on what "good software" (not "good code"!) is, touching ethics, interop, commercials and functionality 🧵

Charity Majors@charity.wtf

for context: the second edition of "Observability Engineering" starts off swinging with an opinionated chapter called "The Fundamentals of Building Good Software". which begs the question... what IS ✨ good software ✨? i'll drop my answers 👇 but curious to hear others.

View full thread
Duncan Brown
@duncanjbrown.com

A few ideas on what "good software" (not "good code"!) is, touching ethics, interop, commercials and functionality 🧵

Charity Majors@charity.wtf

for context: the second edition of "Observability Engineering" starts off swinging with an opinionated chapter called "The Fundamentals of Building Good Software". which begs the question... what IS ✨ good software ✨? i'll drop my answers 👇 but curious to hear others.

Duncan Brown
@duncanjbrown.com

1. Good software works, which means it does what is expected according to the consensus reality shared by the team, the rest of the company, the community, etc, and it can change as the consensus reality changes.

Duncan Brown
@duncanjbrown.com

2. Good software does not pursue lock-in. It seeks to actively participate in open standards and to improve them where tasteful and appropriate. Ideally it does not need to care what its own commercial model is.

Duncan Brown
@duncanjbrown.com

"[Open standards] can feel like a burden to the participants. They should! The alternative is each product imposes its incompatible opinions directly on the users rather than working through the trade-offs with competitors first." Yet as we outsource "the work" to suppliers, we outsource this too.

olizilla@oli.zilla.org.uk

Several current and former NHS staff have told me similar, angry stories about what happens to our old health records after the contract for a new, incompatible IT system is signed. It turns out proprietary storage formats are a problem: oli.zilla.org.uk/2025/10/20/w...

Duncan Brown
@duncanjbrown.com

This morning's AWS outage prompted reflections in NHSE towers that "disaster recovery" and "inclusive services" directly overlap. For instance, the Record a vaccination service have designed a paper-only data capture process for when the internet is unavailable

Rachel Coldicutt@rachelcoldicutt.bsky.social

Wrote a blog post about why there's no such thing as a universal digital service - which may seem counterintuitive "now that everyone has a phone" but it remains as true today as it was 10 years ago. www.careful.industries/blog/2025-10...

careful.industriesThere’s no such thing as a universal digital service  — Careful IndustriesIn a world where Meta has more users than most countries have residents, it seems odd to say that digital services aren’t universal – but universal services need to work for everyone, not just for peo...

Duncan Brown reposted

Rob Bowley
@robbowley.net

Some reflections on @duncanjbrown.com's recent article "Team dynamics after AI", which is one of the best/most important pieces of writing I've read on AI in a long time

blog.robbowley.netOn “Team dynamics after AI” and the Illusion of Efficiency | Rob Bowley
Rob Bowley@robbowley.net

This is now the favourite thing I've read on AI. Why the idealistic AI maximalist dreams just do not stack up. Can't recommend it enough. Long read, so grab yourself 15 mins without distraction. Sure I'll be coming back to it many times

Duncan Brown reposted

AndreasThinks
@andreasthinks.me

If you're interested in UK #govtech or #opendata, the Incubator for AI have just open-sourced this like of "Awesome UK Government Datasets" and are looking for contributors! github.com/i-dot-ai/awe...

github.comGitHub - i-dot-ai/awesome-gov-datasets: A curated set of references to useful UK Government datasetsA curated set of references to useful UK Government datasets - GitHub - i-dot-ai/awesome-gov-datasets: A curated set of references to useful UK Government datasets