Yes, he literally demands devs who don't accept LLM security reports to be removed from the project.

Projects that continue to prohibit AI-generated vulnerability reports are no longer suitable dependencies for GNOME, and should be developed someplace other than GNOME GitLab.

you are viewing a single comment's thread
view the rest of the comments
[–] -1 points 1 month ago* (1 child)

Good point. The article addresses this, their point is that the bar for sending reports in should be as low as possible and requiring re-authoring might make people not submit at all. While I agree with the author, that is still a debatable point though. I guess we would need to know how many valuable reports are actually lost by not allowing LLM-authored vulnerability reports, which is hard to do quantitatively

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 month ago

    That's a fucking stupid argument. If the issue is worth addressing, the issue is worth writing up an issue.

    LLM-authored issues are the absolute fucking worst. I can't tell you how many times I've had to deal with either completely fabricated issues or issues where the LLM generates bullshit "details" as though it actually investigated the issue, making it next to impossible to determine what is real or not.

    It's not that fucking hard to just write up issues you find. We've been doing it for decades just fine, jfc.

  • source
  • parent