I created a code review pipeline at work with a similar tradeoff and we found the cost is worth it. Time is a non-issue.

We could run Claude on our code and call it a day, but we have hundreds of style, safety, etc rules on a very large C++ codebase with intricate behaviour (cooperative multitasking be fun).

So we run dozens of parallel CLI agents that can review the code in excruciating detail. This has completely replaced human code review for anything that isn't functional correctness but is near the same order of magnitude of price. Much better than humans and beats every commercial tool.

"scaling time" on the other hand is useless. You can just divide the problem with subagents until it's time within a few minutes because that also increases quality due to less context/more focus.

> “Not much. The real incentive for finding a vulnerability in cURL is the fame ('brand is priceless'), not the hundred or few thousand dollars. $10,000 (maximum cURL bounty) is not a lot of money in the grand scheme of things, for somebody capable of finding a critical vulnerability in curl.”

That's the choice as seen from the perspective of a white-hat hacker. But for an exploitable vulnerability, the real choice is to sell it to malware producers (I'm including state-sponsored spyware companies like the makers of Pegasus in this category) for a lot of money, or do the more moral thing and earn at least a little bit of money via a bug bounty program.

What if something works even if the arguments are unscientific? Example: How to get an apple from high up in the tree where I can't reach? My theory is that if I knock them with a baseball bat they fall because they are afraid of baseball bats and don't want to be hit. I have tested it and it works. A physics teacher I know disagrees, and a biologist disagrees.

What if psychology has such things that just work even if the theory is wrong? The trauma healing layman psychology industry might have a method that works for some people, so that they get into a better mental state.

I wonder if that architecture was designed to prevent emulation.

Because emulators still work insanely hard to make those games work, even today.