Source: https://github.com/gregkh/kernel-development/blob/master/graphs%2Fpatches_per_release%2Fcves_fixed_per_release.png

AI coding tools are pretty good at finding bugs and make it easier and faster to fix them.

Importantly, security vulnerabilities in new releases seem to stay roughly the same and the change to which bugs count as CVEs was around version 6.8 already.

all 31 comments

sorted by: hot top controversial new old
[–] 59 points 2 weeks ago (8 children)

do we have one for regressions ? because that seems to be exploding for every other project.

  • source
  • hideshow 8 child comments
  • [–] 46 points 2 weeks ago (7 children)

    The difference is that Linus uses LLM's as a tool, not as a hands off content creator.

    The LLM points out something a human missed in the same way spell check finds typos. Then a human reads the suggestion and writes the fix.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 11 points 2 weeks ago (6 children)

    if that were entirely true, what i said would not be.

    but yes, in the hands of a skilled professional with over 30 years of experience on a single project it can probably be useful.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 18 points 2 weeks ago (5 children)

    Your statement was about other projects having regressions because developers are using AI to write code for them completely hands off and compared it to Linux where AI is used to make suggestions but a human is ultimately responsible and has to write the patch.

    Apples and Oranges.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 3 points 2 weeks ago (4 children)

    i made no claims about their methodology.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 6 points 2 weeks ago (3 children)

    "if that were entirely true, what i said would not be."

    I explained the difference in methodology and you doubled down as if they were the same.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 2 weeks ago (2 children)

    in that case i should have been more clear. i do not believe it's strictly one or the other, which is why the word "entirely" is in there. you're generalising over a huge range of developer quality and basically saying that they are all worse at building software than linus, despite the fact that we have been seeing regressions in projects like rsync, which has one of the most disciplined maintainers in the foss ecosystem.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 weeks ago (1 child)

    you're generalising over a huge range of developer quality and basically saying that they are all worse at building software than linus

    You claimed that Linux could see regressions just like all other projects DESPITE the different methodology.

    basically saying that they are all worse at building software than linus

    That is claim that any AI use of any type results in regressions. That is obviously false.

    Just because AI suggested using glue on pizza doesn't mean that everyone now puts glue on their pizza.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 weeks ago*

    i claimed no such thing. i asked for a graph because i was interested to know if that was the case.

    and what we've been seeing in the industry lately is that llm use of any kind results in more regressions, because more code is created and it tends towards average quality.

  • source
  • parent
  • [–] 3 points 2 weeks ago

    Those other projects are not at high quality control like Linux. They probably vibe slop it and introduce a lot of regressions. Such data would be interesting on Linux too, just to have some comparison. But I don't think it's exploding regressions, as there is no indication for that so far.

  • source
  • parent
  • load more comments (-1 replies)
    [–] 37 points 2 weeks ago* (2 children)

    For anyone curious about the number of bugs introduced in each kernel release, LWN.net has a plot of Bugs fixed and introduced in each kernel release.

    However, it has the obvious limitation that recent releases will appear to have fewer commits introducing bugs, simply because kernel developers haven't had as much time to find and fix the bugs introduced in those releases. So it'll be a while before we can actually see the consequences (positive or negative) of more widespread LLM usage by kernel developers

  • source
  • hideshow 2 child comments
  • [–] 20 points 2 weeks ago

    As somebody who is quite critical of AI, I will say, it is a fantastic tool for finding bugs early. I advise getting all your changes reviewed by a decent LLM before you push them. It often finds edge cases I forgot in my testing

  • source
  • parent
  • [–] 35 points 2 weeks ago (1 child)

    It will be fascinating when the data is available, to see a graph showing the number of security vulnerabilities added to the kernel with each commit, obviously they'll have to be found and patched before that can be determined.

  • source
  • hideshow 1 child comment
  • [–] 16 points 2 weeks ago (2 children)

    ai, protecting people from ai.

  • source
  • hideshow 2 child comments
  • [–] 8 points 2 weeks ago (1 child)

    yes, you need to find the vulnerabilities before the hackers and it just so happens that LLMs aren't terrible at it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 2 weeks ago

    I think dusk means it would also be difficult for hackers to find these bugs without AI, which probably is true (given how long some of them seem to have existed). Hard to say how it balances out in the end though.

  • source
  • parent
  • [–] 4 points 2 weeks ago (1 child)

    Some people think its bad that so many CVEs are fixed. Because they think without Ai we wouldn't have so many CVEs in the first place... go figure (not my opinion, but I saw such type of comments).

  • source
  • hideshow 1 child comment
  • [–] 2 points 2 weeks ago

    It's natural to think that way if you don't think the implications through - like the infamous WWII plane showing holes in the fusilage and the implications on which parts of the aircraft needed reinforcement. :)

  • source
  • parent
  • [–] 2 points 2 weeks ago (5 children)

    AI coding tools are pretty good at finding writing bugs and make it easier and faster to fix write them.

  • source
  • hideshow 5 child comments
  • [–] 17 points 2 weeks ago (2 children)

    If you checked the commits you would see that some of the bugs in Linux being found with AI tooling have been present for many years.

    I encourage everyone to go have a read for themselves.

    Linux hasn’t become some slop treadmill like you’re implying.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 weeks ago*

    Some of it is due to AI but much of it is people finally paying attention to security. For a long time no one thought about security vulnerabilities. These days many bugs in Linux are considered a security issue and thus gets there own CVE

  • source
  • [–] -4 points 2 weeks ago (3 children)

    This was never an issue before, so it just appears as tho it's adding bugs to be fixed later. Unless all these updates are strategically going somewhere.

  • source
  • hideshow 3 child comments
  • [–] 4 points 2 weeks ago (1 child)

    These were not a problem, because no one found them, but they were still there. Now they are being found, if not by the folks patching them, then by those looking to exploit them. There is no way to navigate this than to patch whatever is found.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 2 points 2 weeks ago

    Many governments and secret groups sit on Zero day exploits for years until they need to use them.

    Average people are finding them easier now using AI, which is a good thing. Instead of 3 letter organizations sitting on them.

  • source
  • parent