282
Linux kernel reviewer steps down from memory management duties due to influx of AI slop patches — 'the amount of time wasted on AI slop is already too much, and we're only at the start of this' (www.tomshardware.com)
submitted 1 day ago by to c/fuck_ai@lemmy.world
35 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 day ago (3 children)

According to the lead Curl developer, the quality of LLM generated reports has gone up quite a lot, to the point where the number of high quality reports is the problem, rather than the number of slop reports: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

However, I doubt that their bug bounty program is ever coming back. As you say, that'll just attract the people looking for a quick buck, and those are unlikely to care about the quality of their reports

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 7 points 1 day ago (2 children)

    That is not what the maintainer of curl said, lmao

    This article explains the actual situation.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 day ago* (1 child)

    The link I posted is to the Curl maintainer's own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that

    I personally don’t refer to [vulnerability reports created with the help of AIs] as AI slop because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 22 hours ago

    This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.

    It’s annoying when the reporter surrender everything to the AI, including the communication part. The AIs are also still bad at figuring out exactly where the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is.

    So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.

    Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.

  • permalink
  • fedilink
  • source
  • parent