Linux kernel memory-management code reviewer steps down due to influx of AI slop patches — volume of submissions coupled with low manpower forces the step back
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
I personally don’t refer to [vulnerability reports created with the help of AIs] as AI slop because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
It’s annoying when the reporter surrender everything to the AI, including the communication part.
The AIs are also still bad at figuring out exactly where the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.
That is not what the maintainer of curl said, lmao
This article explains the actual situation.
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.