The Era of Software Quality, or the Era of Ostriches?
blogs.gnome.org
Humans are bad at writing secure code, and GNOME developers are no exception. GNOME is primarily written using unsafe programming languages where simple mistakes in our code lead to devastating consequences for our users, and we make these mistakes all the time. No matter how much we try, GNOME developers will fail write secure code...

Yes, he literally demands devs who don’t accept LLM security reports to be removed from the project.

Projects that continue to prohibit AI-generated vulnerability reports are no longer suitable dependencies for GNOME, and should be developed someplace other than GNOME GitLab.

  • HaraldvonBlauzahn@feddit.org
    3·
    22 days ago

    their point is that the bar for sending reports in should be as low as possible

    Why?

    Look: The bottleneck is not the number of reported possible issues, but the time, attention, and sustainable workload for the GNOME maintainers and developers. Anything that minimizes the latter is good.

    Also, if LLM tools really continue to improve a lot (which is doubtful IMO), a shitty, half-assed, inconplete, ill-described bug report of today that is not attended to, due to its deficit, is not lost: If the bug is real and persists, due to the proclaimed future advancements in LLM technology, maintainers will receive another much much better bug report which causes less work in a year or two. Since maintainer’s work capacity is the real bottleneck, this is a clear win!