The incentives here are really bad at the moment. Traditionally, your name on a CVE against an important project like curl have a certain cachet in the community. You might even leverage that to get a raise or a better job, so money was definitely part of this.

Now lots of people are throwing code against LLMs and then copy/pasting whatever comes out into "security" reports.

We decided for our projects that any LLM-generated security reports are simply copied to the public list. Everyone has access to LLMs so presumably if one LLM instance found it, then all users of LLMs have already or shortly will find it. We'll fix them if they're important, but the signal to noise is pretty bad.

I think this will, eventually, result in more secure services as the low hanging problems are found and fixed. But unfortunately I don't see the flood of LLM-generated nonsense ending any time soon.

▲

f311a 5 hours ago | parent | next [-]

Unless it's a critical CVE, they're worth very little now for your career.

Same for a lot of side projects or small contributions to OSS, people are still chasing them and wasting everyone's time for nothing. They wouldn't even work on them before AI.

	▲	bluGill 2 hours ago \| parent [-]
		If there is a CVE is has value to your career. You have public recognition that you found one which means someone looking for someone to hire will find you. In turn you are more valuable because a few people are looking. If you company wants to keep you they better give you a proactive raise. Until it is common to verify the quality of the CVE the above will remain true. Perhaps the CVE system needs a "shame" system so that potential hiring manages find you on the list of incompetent people not to hire. (undoubtedly libel laws will make this impossible)

▲

xbmcuser 5 hours ago | parent | prev [-]

In a way I think the false promise of open source that someone else would have gone through the code is actually going to come true as LLM would have gone through the code.