lime comments on Chart of Linux security vulnerabilities fixed per kernel version

Chart of Linux security vulnerabilities fixed per kernel version (media.piefed.social)

submitted 2 weeks ago by Ek-Hou-Van-Braai@piefed.social to c/linux@programming.dev

30 comments fedilink hide all child comments

Source: https://github.com/gregkh/kernel-development/blob/master/graphs%2Fpatches_per_release%2Fcves_fixed_per_release.png

AI coding tools are pretty good at finding bugs and make it easier and faster to fix them.

Importantly, security vulnerabilities in new releases seem to stay roughly the same and the change to which bugs count as CVEs was around version 6.8 already.

[–] lime@feddit.nu 59 points 2 weeks ago (8 children)

do we have one for regressions ? because that seems to be exploding for every other project.

permalink

fedilink

source

hideshow 8 child comments

[–] Blue_Morpho@lemmy.world 46 points 2 weeks ago (7 children)

The difference is that Linus uses LLM's as a tool, not as a hands off content creator.

The LLM points out something a human missed in the same way spell check finds typos. Then a human reads the suggestion and writes the fix.

permalink

fedilink

source

parent

hideshow 7 child comments

[–] lime@feddit.nu 11 points 2 weeks ago (6 children)

if that were entirely true, what i said would not be.

but yes, in the hands of a skilled professional with over 30 years of experience on a single project it can probably be useful.

permalink

fedilink

source

parent

hideshow 6 child comments

[–] Blue_Morpho@lemmy.world 18 points 2 weeks ago (5 children)

Your statement was about other projects having regressions because developers are using AI to write code for them completely hands off and compared it to Linux where AI is used to make suggestions but a human is ultimately responsible and has to write the patch.

Apples and Oranges.

permalink

fedilink

source

parent

hideshow 5 child comments

[–] lime@feddit.nu 3 points 2 weeks ago (4 children)

i made no claims about their methodology.

permalink

fedilink

source

parent

hideshow 4 child comments

[–] Blue_Morpho@lemmy.world 6 points 2 weeks ago (3 children)

"if that were entirely true, what i said would not be."

I explained the difference in methodology and you doubled down as if they were the same.

permalink

fedilink

source

parent

hideshow 3 child comments

[–] lime@feddit.nu 2 points 2 weeks ago (2 children)

in that case i should have been more clear. i do not believe it's strictly one or the other, which is why the word "entirely" is in there. you're generalising over a huge range of developer quality and basically saying that they are all worse at building software than linus, despite the fact that we have been seeing regressions in projects like rsync, which has one of the most disciplined maintainers in the foss ecosystem.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Blue_Morpho@lemmy.world 2 points 2 weeks ago (1 child)

you're generalising over a huge range of developer quality and basically saying that they are all worse at building software than linus

You claimed that Linux could see regressions just like all other projects DESPITE the different methodology.

basically saying that they are all worse at building software than linus

That is claim that any AI use of any type results in regressions. That is obviously false.

Just because AI suggested using glue on pizza doesn't mean that everyone now puts glue on their pizza.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] lime@feddit.nu 1 point 2 weeks ago*

i claimed no such thing. i asked for a graph because i was interested to know if that was the case.

and what we've been seeing in the industry lately is that llm use of any kind results in more regressions, because more code is created and it tends towards average quality.

permalink

fedilink

source

parent

[–] thingsiplay@lemmy.ml 3 points 2 weeks ago

Those other projects are not at high quality control like Linux. They probably vibe slop it and introduce a lot of regressions. Such data would be interesting on Linux too, just to have some comparison. But I don't think it's exploding regressions, as there is no indication for that so far.