← Back to context

Comment by ReDress

5 hours ago

I don't think AI is of much concern, if you actually have a valid security issue.

No-one, really will care if you discovered it via AI or otherwise. Because, the weight of the bug itself should outweight other concerns. This is how professional security works. There will always be one concern or the other about a bug but what carries more weight will determine the direction that the disclosure process takes.

A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.

Anyways, it mostly seems like people don't really care much about computer security at Linux. I would like to think they care more about infrastructure and related security issues because, well, if my computer is an open book, then why would security issues around it be a concern?

Anyways...

Enough said here - lol

5 comments

ReDress

Reply
john_strinlai  5 hours ago

>A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.

that's not really what the policy is about.

the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.

  • pelotron  3 hours ago

    My sinister side wonders if part of it could be that if you found it via AI but it turns out to be a hallucination, then you must accept the public ridicule for not thoroughly vetting the AI output.

  • ReDress  4 hours ago

    As much as I am concerned. Security is not a concern in most open source projects.

    But, for one reason the other, they might give credit to a vulnerability they find interesting.