§ 101
Brandolini's Law
Refuting a false claim takes far more effort than making it, so a stream of cheap claims can swamp the people who have to check them.
Keep in mind
Make a claim carry its own evidence before you spend yours on it
What to do
Where claims arrive faster than you can check them (bug reports, review comments, security disclosures), ask the claimant for the evidence up front: steps to reproduce, a failing test, the log. Timebox the first look, and watch what a reward attracts: even one paid only for confirmed results can draw more claims than you can check, and then it is better dropped. Do not use this to wave away a short report from someone with nothing to gain; a terse report that reproduces deserves full attention.
Why it happens
A claim can be stated in one line; showing it is wrong means reading the context, reproducing the case and writing up why it fails. The person making the claim pays the first cost and the checker pays the second, and nothing stops the first from being much cheaper. curl's security team has seven members; in 2025 each incoming report drew three or four of them, by Stenberg's estimate for 30 minutes and sometimes up to three hours each; as of early July 2025, about 20% of that year's submissions so far were AI slop and about 5% had turned out to be genuine vulnerabilities. When producing a claim gets cheaper, as generated text has made it, the gap widens.
In practice
curl ended its bug bounty, officially on January 31, 2026. In his January 2026 post, Daniel Stenberg wrote that in previous years somewhere north of 15% of submissions ended up as confirmed vulnerabilities, but "Starting 2025, the confirmed-rate plummeted to below 5%." He named AI slop among the reasons and said the change was "In an attempt to remove the incentives for submitting made up lies."
Read the accountWhen it stops applying
Cunningham's Law: in front of people who know the subject, a wrong claim often draws its correction quickly and for free, so posting your best guess and letting others fix it can beat holding back until every claim is checked.
Source
Alberto Brandolini, tweet (Twitter, 11 January 2013) — "The bullshit asimmetry: the amount of energy needed to refute bullshit is an order of magnitude bigger than to produce it." (spelling as in the tweet itself; Wikipedia's citation retitles it); Daniel Stenberg, "Death by a thousand slops" (daniel.haxx.se, July 2025) — the curl security team's numbers as of early July 2025; Daniel Stenberg, "The end of the curl bug-bounty" (daniel.haxx.se, January 2026) — the example, including the confirmed rate from 2025 on.
Read the sourceCite this
Hammurabi, § 101, “Brandolini's Law.” https://kanywst.github.io/hammurabi/laws/brandolinis-law/
BibTeX
@misc{hammurabi-brandolinis-law,
title = {Brandolini's Law},
author = {{Hammurabi contributors}},
note = {Hammurabi, § 101},
url = {https://kanywst.github.io/hammurabi/laws/brandolinis-law/}
}Read in a column
- When AI writes the code Next in the column: Automation Bias
Related laws
- 26Cunningham's LawPeople are quicker to correct a wrong answer than to answer a question.
- 35Linus's LawA bug that stumps one person is often obvious to someone else looking at the same code.
- 22Kernighan's LawDebugging is harder than writing, so code written at your cleverest is beyond your debugging.
- 102Automation BiasPeople working with an automated aid tend to let it stand in for their own checking: they miss what it fails to flag and follow it when it is wrong.