Replies: 1 comment 5 replies
-
|
One solution could be to charge a deposit if you want to participate in the bug bounty programme. If a report is classified as slop, the deposit is donated to a charitable cause. Anyone who wants to report something voluntarily without paying a deposit simply does not participate in the bug bounty programme. |
Beta Was this translation helpful? Give feedback.
5 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
You may have noticed that activity on the public Log4cxx, Log4j, and Log4net repositories has slowed since December 2025.
I want to reassure you that the projects are still being actively monitored. Much of this work is simply invisible, as it is currently concentrated on handling security reports.
Since December, we have been experiencing what is effectively a denial-of-service situation through our YesWeHack bug bounty program:
For comparison, the community opened only about 20 regular bug reports against Log4j during the same three-month period.
This does not mean that dozens of serious vulnerabilities are waiting to be disclosed. Most reports since 2024 already show signs of AI-assisted generation, and recent submissions are overwhelmingly AI-generated. In practice, perhaps one out of twenty reports represents even a minor, legitimate issue.
Nevertheless, we currently treat these submissions like any other report and strive to provide thoughtful, high-quality responses, even when the input itself is very low quality. Because security reports are handled with the highest priority, this situation now consumes a disproportionate share of our available volunteer effort.
It is time to draw a line.
Context
Log4j is not the only project affected by AI-generated report spam. For example:
While we wait for broader, ecosystem-level solutions, we need a temporary approach that preserves our scarce resources.
Proposal
The PMC and each of its member will decide how much time to dedicate to reviews in light of this new AI generation slop problem. For example, I do not plan to spend more than 20% of my Log4j time addressing these reports.
This does not mean ignoring security submissions. Instead, reports will be quickly classified as either serious or questionable, with only the first category receiving immediate priority.
Reports in the second category will still be processed as time permits, even if that means waiting weeks or months for an assessment.
Beta Was this translation helpful? Give feedback.
All reactions