> If you resorted to AI assistance to identify a bug, you must treat it as public. https://github.com/torvalds/linux/blob/master/Documentation/...
I do not imagine that things divide so clearly along these lines.
No-one, really will care if you discovered it via AI or otherwise. Because, the weight of the bug itself should outweight other concerns. This is how professional security works. There will always be one concern or the other about a bug but what carries more weight will determine the direction that the disclosure process takes.
A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.
Anyways, it mostly seems like people don't really care much about computer security at Linux. I would like to think they care more about infrastructure and related security issues because, well, if my computer is an open book, then why would security issues around it be a concern?
Anyways...
Enough said here - lol
that's not really what the policy is about.
the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.
But, for one reason the other, they might give credit to a vulnerability they find interesting.
are you actively pointing your LLM at the kernel to identify security bugs?
the policy wasn't made on a whim. to quote the linux security team: "bugs discovered this way [via ai] systematically surface simultaneously across multiple researchers, often on the same day."
>Responsible disclosure
the term responsible disclosure is a silly thing made up by vendors.
Now, the question is can we make some kind of formal verification language that forces checks everything and doesn't allow bugs? Maybe?
But that's assuming the underlying hardware and firmware doesn't have flaws that can break those assumptions too.
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
But they have also disabled Linux as one of the products that they work with.
The boss class are rich because they're smart. /s
Fixed that for you
This is like saying "Linux source code leaked"
I feel paranoid enough now to blame ai companies to try to induce panic and proclaim "buy our product to save yourself"
Does the security flaw exist or not?
I've always been one for immediate release of any security flaw the second it is found.
"But, people will get hurt or lose money that way"
Correct, they will understand the risk of using computer systems. Because we've hidden all the flaws under a mask of responsible disclosure people really don't understand the dangers we've subjected ourselves to by writing a bunch of bug filled bullshit code and instead we pretend like we have a handle on the situation.
WE DO NOT. If AI has proven anything it's how all of our code is a giant stack of cards waiting till collapse. And it proves humans will never learn, we'll just use the AI to pump out more shitty bug filled code.
It's all fun and games until someone crashes the electrical grid via bugs, or a major incident on the banking system. Human love to write regulations in blood because we're incapable of doing anything correctly before a bunch of people die.
It probably just happens that the security concerns at ZDI don't match the security concerns at Linux(the vendor).
So, it turns out that this vendor is difficult to work with ....
I mean - heh