Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities

▲

smashed 2 hours ago | parent | next [-]

On first glance it seems you are right.

> If you resorted to AI assistance to identify a bug, you must treat it as public. https://github.com/torvalds/linux/blob/master/Documentation/...

▲

ReDress an hour ago | parent [-]

I don't think AI is of much concern, if you actually have a valid security issue.

No-one, really will care if you discovered it via AI or otherwise. Because, the weight of the bug itself should outweight other concerns. This is how professional security works. There will always be one concern or the other about a bug but what carries more weight will determine the direction that the disclosure process takes.

A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.

Anyways, it mostly seems like people don't really care much about computer security at Linux. I would like to think they care more about infrastructure and related security issues because, well, if my computer is an open book, then why would security issues around it be a concern?

Anyways...

Enough said here - lol

▲

john_strinlai an hour ago | parent [-]

>A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.

that's not really what the policy is about.

the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.

	▲	ReDress an hour ago \| parent [-]
		As much as I am concerned. Security is not a concern in most open source projects. But, for one reason the other, they might give credit to a vulnerability they find interesting.

▲

rwmj an hour ago | parent | prev [-]

As it should. If an LLM discovered them you should assume that another LLM, or another person running the same LLM, could find them. They are effectively public already.

▲

wilkystyle an hour ago | parent [-]

No. I have an LLM and didn't discover it. Folks in HR have LLMs but can't produce the same software you can. Just because an LLM could discover it does not mean that it has been discovered yet. Responsible disclosure is still a valuable thing.

▲

john_strinlai an hour ago | parent [-]

>I have an LLM and didn't discover it.

are you actively pointing your LLM at the kernel to identify security bugs?

the policy wasn't made on a whim. to quote the linux security team: "bugs discovered this way [via ai] systematically surface simultaneously across multiple researchers, often on the same day."

>Responsible disclosure

the term responsible disclosure is a silly thing made up by vendors.

	▲	yreg 17 minutes ago \| parent [-]
		You could say that there is no reason to report them at all, because the maintainers can point llms to the kernel themselves.