Comment by john_strinlai
6 hours ago
>A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.
that's not really what the policy is about.
the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.
My sinister side wonders if part of it could be that if you found it via AI but it turns out to be a hallucination, then you must accept the public ridicule for not thoroughly vetting the AI output.
As much as I am concerned. Security is not a concern in most open source projects.
But, for one reason the other, they might give credit to a vulnerability they find interesting.
We're talking specifically about the Linux kernel. Do you have any reason to say that they don't think that security is a concern?
The linux kernel maintainers tend to go a little against the grain in terms of approach to security. Primarily they tend to resist the categorisation and ranking of bugs by security impact, instead insisting that more or less all bugs are equal and you should just update to the latest version regularly if you want to remain secure.
Because open source Linux is a fad and Linus needs to beaten in the toes with a small stick.
Very childish