I like to be AI sceptical as well but I think it's even more noticeable if the flaw is in 20 year old code which thousands of people have read and reviewed and not noticed, isn't it?

▲

ashfg1 4 hours ago | parent | next [-]

Hardly anyone reads and reviews in open source. It is a myth from ESR. Probably one person wrote it and another one said LGTM.

	▲	bitwize 4 hours ago \| parent [-]
		Today ESR would say "All bugs are really shallow this time, thanks to our robot friends!"

▲

pizzafeelsright 4 hours ago | parent | prev [-]

The recent signed keys being '4' is an example.

Looks good, validates, works, and then trust is assumed.

▲

basilikum 3 hours ago | parent [-]

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.

	▲	pizzafeelsright an hour ago \| parent [-]
		It was assumed the private keys were private, not easily figureoutable, so they were most likely never tested.