The Era of Software Quality, or the Era of Ostriches?
blogs.gnome.org
Humans are bad at writing secure code, and GNOME developers are no exception. GNOME is primarily written using unsafe programming languages where simple mistakes in our code lead to devastating consequences for our users, and we make these mistakes all the time. No matter how much we try, GNOME developers will fail write secure code...

Yes, he literally demands devs who don’t accept LLM security reports to be removed from the project.

Projects that continue to prohibit AI-generated vulnerability reports are no longer suitable dependencies for GNOME, and should be developed someplace other than GNOME GitLab.

  • PotatoesFall@discuss.tchncs.de
    9·
    15 days ago

    They actually make a good case and have the numbers to back it up. AI has gotten quite good at spotting vulnerabilities, acknowledging that doesn’t mean being pro-AI. Ignoring it means deliberately allowing vulnerabilities. None of this entails LLM-generated code being merged into GNOME

    • ell1e@leminal.spaceEnglish
      7·
      15 days ago

      I saw this nice response below:

      Look, if you scan code, find an exploit, write a clean patch, and submit it, nobody will give a fuck what scanning software you used.

      It is the part after scanning that matters. That’s what people are upset about.

      If this dev feels like AI scans are so important, why doesn’t the dev just scan that way but then write manual bug reports? That would satisfy the no LLM bug reports rule. The problem posed in the article doesn’t seem to actually seem to exist, unless whenever people are too lazy to write a bug report on their own.

      • PotatoesFall@discuss.tchncs.de
        1·
        15 days ago

        Good point. The article addresses this, their point is that the bar for sending reports in should be as low as possible and requiring re-authoring might make people not submit at all. While I agree with the author, that is still a debatable point though. I guess we would need to know how many valuable reports are actually lost by not allowing LLM-authored vulnerability reports, which is hard to do quantitatively

        • expr@programming.dev
          6·
          15 days ago

          That’s a fucking stupid argument. If the issue is worth addressing, the issue is worth writing up an issue.

          LLM-authored issues are the absolute fucking worst. I can’t tell you how many times I’ve had to deal with either completely fabricated issues or issues where the LLM generates bullshit “details” as though it actually investigated the issue, making it next to impossible to determine what is real or not.

          It’s not that fucking hard to just write up issues you find. We’ve been doing it for decades just fine, jfc.

        • HaraldvonBlauzahn@feddit.org
          3·
          14 days ago

          their point is that the bar for sending reports in should be as low as possible

          Why?

          Look: The bottleneck is not the number of reported possible issues, but the time, attention, and sustainable workload for the GNOME maintainers and developers. Anything that minimizes the latter is good.

          Also, if LLM tools really continue to improve a lot (which is doubtful IMO), a shitty, half-assed, inconplete, ill-described bug report of today that is not attended to, due to its deficit, is not lost: If the bug is real and persists, due to the proclaimed future advancements in LLM technology, maintainers will receive another much much better bug report which causes less work in a year or two. Since maintainer’s work capacity is the real bottleneck, this is a clear win!