The Era of Software Quality, or the Era of Ostriches?
blogs.gnome.org
Humans are bad at writing secure code, and GNOME developers are no exception. GNOME is primarily written using unsafe programming languages where simple mistakes in our code lead to devastating consequences for our users, and we make these mistakes all the time. No matter how much we try, GNOME developers will fail write secure code...

Yes, he literally demands devs who don’t accept LLM security reports to be removed from the project.

Projects that continue to prohibit AI-generated vulnerability reports are no longer suitable dependencies for GNOME, and should be developed someplace other than GNOME GitLab.

  • ell1e@leminal.spaceEnglish
    7·
    11 days ago

    I saw this nice response below:

    Look, if you scan code, find an exploit, write a clean patch, and submit it, nobody will give a fuck what scanning software you used.

    It is the part after scanning that matters. That’s what people are upset about.

    If this dev feels like AI scans are so important, why doesn’t the dev just scan that way but then write manual bug reports? That would satisfy the no LLM bug reports rule. The problem posed in the article doesn’t seem to actually seem to exist, unless whenever people are too lazy to write a bug report on their own.

    • PotatoesFall@discuss.tchncs.de
      1·
      10 days ago

      Good point. The article addresses this, their point is that the bar for sending reports in should be as low as possible and requiring re-authoring might make people not submit at all. While I agree with the author, that is still a debatable point though. I guess we would need to know how many valuable reports are actually lost by not allowing LLM-authored vulnerability reports, which is hard to do quantitatively

      • expr@programming.dev
        6·
        10 days ago

        That’s a fucking stupid argument. If the issue is worth addressing, the issue is worth writing up an issue.

        LLM-authored issues are the absolute fucking worst. I can’t tell you how many times I’ve had to deal with either completely fabricated issues or issues where the LLM generates bullshit “details” as though it actually investigated the issue, making it next to impossible to determine what is real or not.

        It’s not that fucking hard to just write up issues you find. We’ve been doing it for decades just fine, jfc.

      • HaraldvonBlauzahn@feddit.org
        3·
        9 days ago

        their point is that the bar for sending reports in should be as low as possible

        Why?

        Look: The bottleneck is not the number of reported possible issues, but the time, attention, and sustainable workload for the GNOME maintainers and developers. Anything that minimizes the latter is good.

        Also, if LLM tools really continue to improve a lot (which is doubtful IMO), a shitty, half-assed, inconplete, ill-described bug report of today that is not attended to, due to its deficit, is not lost: If the bug is real and persists, due to the proclaimed future advancements in LLM technology, maintainers will receive another much much better bug report which causes less work in a year or two. Since maintainer’s work capacity is the real bottleneck, this is a clear win!