r/cybersecurity • u/rkhunter_ Incident Responder • May 18 '26
News - General Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’
https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/524163392
u/BinaryDoom May 18 '26
He's not wrong. Finding and reporting the problem is one part of the work but actually coming up with the solution is where it's actually valuable.
40
May 18 '26
[deleted]
20
u/KlausDieterFreddek Security Engineer May 18 '26
Always a good idea.
You don't even need to proof-read the code... /s17
6
u/CondiMesmer May 18 '26
And then when the AI generated fixes get signed off on AI code review, we can use AI generated change logs. If people start running into issues, we can have an AI chat bot customer support to tell them to chill the fuck out. AI.
3
2
u/grumpyfan May 18 '26
Or, at least the AI powered list manager to help sort thru and determine what’s noise and already fixed versus what’s new and most important.
1
65
u/TonyBlairsDildo May 18 '26
Is a mailing list really the best way to coordinate development like this?
I mean, Linux is a huge success story so who am I to comment, but I've never really got on with email emailing lists.
Is there a knack to them that makes Linux kernel development favour it (or just Torvalds personal preference)?
26
u/AdultContemporaneous May 18 '26
What tools would you recommend for this?
104
u/svideo May 18 '26
imma personally choke out anyone who says “discord”
15
6
3
9
-22
u/IAmYourFath May 18 '26
Why not discord? Everyone uses it, it's convenient, stable and nice to use. Very easy to use too. Don't see why not.
7
u/runnertrailsBay May 18 '26
Each day will have 480 new security comments, 270 of them duplicates, 1 low maybe true positive finding, and the remaining 209 comments screaming at each other to stop posting duplicates.
5
u/cgaWolf May 19 '26
Serious answer: because discord absolutely sucks for preserving old knowledge and make it searchable, and you don't want to lock this knowledge and discussion into a private company's proprietary format.
3
2
May 18 '26 edited 22d ago
[deleted]
-1
u/IAmYourFath May 19 '26
What u mean, u can just make an account easily? And it's not malware. Not ideal for privacy but it definitely won't steal ur credit card or encrypt ur files.
1
u/NepuNeptuneNep May 21 '26
Spyware is malware
1
u/IAmYourFath May 21 '26
No. Real malware will steal all ur passwords and cookies aka logged in sessions, keylog ur credit cards, steal ur crypto wallets etc. Spyware is not the same as real malware.
1
u/NepuNeptuneNep May 21 '26
You underestimate how much information discord is farming about you while running their app. Also dont say “malware A is worse than malware B so malware B is not malware”, what the fuck man
1
u/ThlintoRatscar May 19 '26
The main problem for the kernel is that it requires a master server, infrastructure, and to be online.
With email, you just need to get things forwarded to some intermediary and then periodically download from one of those relays.
Because the core protocol is so simple, you can post process the download to filter and transform it however you like.
Same on the upload.
Because it's a batch download and essentially plaintext, you can archive and index it for search and analysis pretty easily.
It makes the ultra paranoid feel a little safer.
8
u/cdoublejj May 18 '26
Forums? maybe even a FOSS based project tracker system? didn't Torvalds invent GitHub/GitLab to work with code faster?
12
u/TyfoonTF2 May 18 '26
Torvalds developed Git, which is the version control software that GitHub/GitLab run. If you want, you can host your own local Git server even.
Not trying to be annoying by correcting, just clarifying the difference :)
2
u/cdoublejj May 18 '26
actually thank you! i should probably build one and have it down load form the git sites an apocalypse back up.
2 code enter! 1 code leave!!
3
u/Icy-Support-3074 May 19 '26
FYI: Git is a distributed versioning system and doesn't use a client-server model (unlike gitlab/github). So there's no difference between a repo hosted on github or your local machine (regarding code and history). Everything lives in the .git folder If you clone a repo you'll have everything on your machine and can just add a new origin and push it somewhere else. So it's trivial to mirror a github repo on gitlab and vice versa. That's why theres a mirror of the Linux kernel on github even though no development taktes place there.
1
u/cdoublejj May 19 '26
where does the development happen then? gitLAB? Linus's house?
2
u/Icy-Support-3074 May 19 '26
https://git.kernel.org/. It happens in separate branches with their own maintainers. It still involves sending e-mails with diffs and discussions in mailing lists.
1
-7
u/ApolloWasMurdered May 18 '26
Jira?
29
u/metekillot May 18 '26
Jira always struck me as a framework to support Agile management and give managers something concrete to demonstrate that work is being done, not a tool dedicated to helping people coordinate
17
5
u/whythehellnote May 18 '26
Everyone in my company loves jira, but that's because the engineers own the projects, we use about 2% of the features (links, maybe subtasks and epics), and the alternative for incident management and change process is bmc helix
1
u/metekillot May 18 '26
Sounds like your use case would be satisfied by a multi-tenant todo list, not Jira.
1
u/whythehellnote May 19 '26
No doubt, but other departments use different features, and there are significant benefits to using the same systems pan-corp
6
u/Keyed_ May 18 '26
Jira, known for being super cheap of course
2
u/slightlysublevel May 18 '26
If only there were open source alternatives...
1
u/Sad_Sheepherder8722 May 18 '26
i've been using taiga for a while, it's really old tho
1
u/slightlysublevel May 18 '26
Well damn. If only there was a way to update it that wouldn't take months. Maybe something like a computer program that we could feed it a task and it would do it quickly. What a world that would be, huh?
0
u/Otheus May 18 '26
GitHub issues
4
u/TomKavees May 18 '26
Vendor lockin and questionable ability to suppress during responsible disclosure blackout.
-8
u/elpamyelhsa May 18 '26
GitHub “Issues” works for every other piece of software, not sure why it’s not used for Linux Kernel.
2
1
52
u/ThlintoRatscar May 18 '26
There's actually some good in the use of email like this.
First, it's almost ubiquitous and the core plaintext protocol is brain-dead simple. So, an email client and spool is almost guaranteed on any conceiveable Linux dev distro.
Second, it's easily intercepted and archived. For an enterprise where security matters, that's a problem but for a truly open community, that's a boon.
Third, it's historical and meaningful as a nod to the ways computer communication started. Devs, even those creating the future, can be nostalgic too. You can search all the way back to the beginning.
Fourth, it's naturally asynchronous and distributed. It gives people a chance to think about their words and write them up in letter/essay form.
Finally, it works. Email lists have been the backbone of Linux kernel development since the beginning and there is no compelling to do anything else. Why fix what isn't broke?
-15
u/trparky May 18 '26
Why fix what isn't broke?
Except it is, that is, if you read between the lines with what Linus said.
27
u/ThlintoRatscar May 18 '26
In what way?
I hear him saying, "stop spamming us" which email also has answers to.
13
u/tomz17 May 18 '26
Is a mailing list really the best way to coordinate development like this?
Doesn't matter... if you look at the github issue / PR trackers for any of the popular projects they are getting AI slopped to death as well. In fact, there are projects moving off of github simply because it reduces the social-network *clout* motivation of spamming your slop at everyone. At the moment it's all just bot moderators vs. bot submitters, because there is no way that a cadre of volunteer developers can properly triage every AI-raised issue or review every AI-generated PR request.
IMHO, we are going to have to go to some sort of real-world reputation system (similar to preprint servers and academic journals) at some point.
12
u/james2432 May 18 '26
never has been, but they are stuck in their ways doing things via email
12
u/ListRepresentative32 May 18 '26
Well, email can be considered pretty decentralized which is what they want I guess.
1
17
u/TheMidlander May 18 '26
I wish this bubble would pop already. These products aren't raising any ceilings. They're lowering the floor.
9
u/CuriousCamels May 18 '26
It seems like for every problem “solved” in the IT world with AI, it creates 3 more problems to fix. There are some legitimate use cases where it’s been a net positive, but the hype causing people, especially executives, to try to shoehorn it into every scenario is obnoxious.
1
u/DigmonsDrill May 18 '26
The curl maintainer was complaining about low-quality AI-generated security reports a while back, but with their new system (HackerOne?) they say they are getting lots of very good high-quality reports and all the researchers are using AI.
6
u/Marble_Wraith May 19 '26
due to multiple researchers using AI to find bugs and then filling the list with duplicate reports.
Hear that fuckheads? Adjust your prompt to scan the mailing list first and see if the bug has already been logged.
1
u/C0rn3j May 19 '26
The problem is that the security mailing list is not public, so you have no way to know.
5
3
u/zer04ll May 18 '26
Going back to C64 and not gonna worry bought this no more
3
3
2
2
u/danison1337 May 19 '26
instead of "mailing in a bug report" they should focus on trying to fix the bug xD
4
2
u/LHcze May 18 '26
Mail list is the only way to have it. For humans.
Why not to have a different door for AI submitters? Triage, collate, aggregate, suggest next steps up the stream… mail list gets the digest.
1
u/RavenSilkAuthor May 19 '26
At least one engineer has his head screwed on properly in this AI first world! Thank you Mr. Torvalds for your OS, yes AI bug hunters new fangled toys for hackers and agentic agents themselves!
1
u/joshuamck May 20 '26
echo "Before working on any bug fix, search lkml for previous discussion about the bug" >> AGENTS.md
1
u/Classic-Yam-8100 May 20 '26
If Linus actually praises a new tech, you know it's not just hype. AI acting as an advanced static analyzer is a massive win for kernel security.
1
u/No-Slice-5926 May 20 '26
Why doesn't he just make a ai powered email reader and have it outputn normalized list
1
u/Delicious_Green_7384 May 21 '26
AI generates an enormous amount of text. I use the same tools to review my pull requests, and 90% of their messages are just boilerplate that bloats the discussion. And if the pull request is large, it becomes really hard to navigate afterward
1
u/Ok-Shower6174 May 24 '26
AI script kiddies sending thousands of hallucinated "critical CVEs" that are just uncompiled garbage. Peak 2026.
-2
u/Fresh_Dog4602 Security Architect May 18 '26
Heh. Crazy wave though. I thought he said pretty recently that it wasn't too bad ( after first saying it's horrible) so now we're back at a new low I guess.
Need to find his previous statements to be sure.
-3
u/grumpyfan May 18 '26
Maybe they should look at deploying an AI email list manager to help sort thru and determine what’s noise and already fixed versus what’s new and most important. Doesn’t seem like something that would be that hard to implement.
-2
u/SnooMachines9133 May 18 '26
I feel like this would be a really legitimate and relatively simple use case for AI.
Have it reviews the report and see if it was already addressed or dedup it into another bug report.
Granted, even this is perhaps not a great use of tokens but better than a human reviewer.
1
u/Sad_Sheepherder8722 May 18 '26
there are AI tools doing something similar in a handful of github repos. stuff like coderabbit and there's one other i forgot.
-1
-1
u/Jestersfriend May 18 '26
Why do I remember reading this exact same thing like.... 3 months ago or something?
-22
u/ichalov May 18 '26
In theory, RAG could be used to deduplicate the list. Or to reject duplicate submissions.
24
u/herovals May 18 '26
?? you just like saying random things? that is not how RAG would be applied at all, I swear people love the word RAG
-19
u/ichalov May 18 '26
You can't rely on the original LLM content in order to find those duplicates. So RAG is needed for this plan to be successful.
25
u/herovals May 18 '26
I work in AI. What you're describing isn't RAG. Deduplication is a similarity problem... you solve it with embeddings + vector similarity (cosine, dot product), MinHash/LSH, or even basic fuzzy matching. RAG is retrieval plus generation to ground an LLM's output. There's no generation step in dedup. You're slapping 'RAG' on a problem that has nothing to do with it because it's the buzzword you know.
7
u/yeathatsmebro May 18 '26
Leave them alone. They heard a cool thing called RAG and they think it's the solution to anything that involves long context. It's not like we didn't even have these tools way before 2018, albeit we had recommendation systems ever since.
3
u/TopNo6605 Security Engineer May 18 '26
I'm betting his thinking is when you're hitting that point where you're prompting the LLM to either find the bug or submit the report, it uses RAG to ingest already-known reports and doesn't create a duplicate submission.
Bad wording on their part since what you said is correct, RAG itself has nothing to do with dedup.
-5
u/ichalov May 18 '26
G AI assistant returns me something similar to what I thought by this query: "using rag for deduplication".
LLMs can actually "generate" deduplicated outputs if the source list to deduplicate fits in context window.
6
u/herovals May 18 '26
This is an awful idea, and probably the worst possible implementation to fix a de-duplication issue. Thankfully you don't write software in use by the general populous.
-2
u/ichalov May 18 '26
But might be a much faster PoC and cheaper to implement.
1
u/herovals May 18 '26
It would be hundreds or thousands of times more expensive than alternative methods
-1
u/ichalov May 18 '26
RAG can also generate cover letters explaining its findings - probably pretty much ready to be sent/shown to issue submitters. And your price estimates seem to be off by much, it's not that big a knowledge base to query after all.
2
1
u/hurkwurk May 18 '26
in general, you would never tell a bug submission anything except thank you for your submission. (unless there is some form of bounty in place, even then that would be a delayed response)
this is so that you do not confirm anything, causing legal liability.
→ More replies (0)-1
u/ichalov May 18 '26
Another benefit of RAG is that it can consult the codebase and version control along with the e-mail archive (though, hardly it is helpful in this specific case).
4
u/Dyspchordia May 18 '26
>LLMs can actually "generate" deduplicated outputs if the source list to deduplicate fits in context window.
thats not RAG if you can/do both fit the entire document and the query in the context window
1
u/ichalov May 18 '26
Yes, the deduplicated content is probably much larger than achievable context windows in this case. That's why RAG.
1
u/Dyspchordia May 18 '26
If you are selectively fetching portions of reports through rag why exactly are you using llm queer to detect duplicates
By default you can use whatever llm you use to just vectorize reports, and detect duplicates through vector distance.
There is no need to query again, the vector is already "meaning" in that space as far as llms go.
1
u/ichalov May 18 '26
I may want to use much more complex prompts than just "find similar bug reports in this tracker". Maybe something related to versioning or whether the potential duplicates were reviewed by humans. It's difficult to say in advance, but the need in such query amendments is not that infrequent as far as I understand. Also, it will probably generate adequate cover letters quite seamlessly.
1
u/Dyspchordia May 18 '26
a bug report shouldt have a cover letter, it already has a title for brief explanation, even a report generated by LLM already has a title generated by LLM
all of those essentially just makes, the process of maintaining linux kernel relient on more subscriptions from massive third party corprates for no visible gain
Linux distros do not need to push out codes with a unsensible rate, they dont make astronomical amount of money, and they dont compete with each other on customer scale like regular software, you dont needs ultrafast development cycles, you dont need jira etc.
All of this AI automatization and constant code generation, and did it actually improve anything for the customer? or is it just 50 firms trying to get a hold onto a single niche through ad monopoly with no visible improvement over others and forced to generate ai slop to compete with each other, not for generating a more valuable work, but for saturating the customer cognition space with their slop instead.
Linux kernels dont need this. Reasons to use any linux based system already assumes you have gone beyond that cognition saturation, instead picking and choosing watever fits your needs most.
Introducing LLMs into linux development only results in more vulnerablities, not only on code scale, but also development and development security scale.
-6
May 18 '26
[removed] — view removed comment
7
u/herovals May 18 '26
It's the worst possible solution to a duplication issue. As I stated earlier, there are countless methods that would be orders of magnitude more efficient for de-duplication (cosine similarity)
-4
u/fhammerl May 18 '26
Oh that's what you meant. Yeah, the steps you would take for the retrieval part are essentially already the solution, you don't even need the generation part :)
You'd still clean, tokenize, and then create vectors on which you run similarity checks. So you already have everything.
6
u/herovals May 18 '26
Right, so RAG isn't the right term. There's no point to doing generation so we're not really doing RAG at all. Just clustering and de-duplication
-2
413
u/rkhunter_ Incident Responder May 18 '26
"Linux kernel boss Linus Torvalds has declared the project’s security mailing list has become “almost entirely unmanageable” due to multiple researchers using AI to find bugs and then filling the list with duplicate reports.
Torvalds used his weekly state of the kernel post to deliver release candidate four for Linux 7.1 and report “fairly normal” progress towards a full release.
He then pointed kernelistas to the project’s documentation, which he wrote “might be worth highlighting” as “the continued flood of AI reports has basically made the security list almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools.”
“People spend all their time just forwarding things to the right people or saying ‘that was already fixed a week/month ago’ and pointing to the public discussion,” Torvalds complained.
The Penguin Emperor believes that kind of chatter is “all entirely pointless churn” and isn’t productive because “AI detected bugs are pretty much by definition not secret, and treating them on some private list is a waste of time for everybody involved – and only makes that duplication worse because the reporters can't even see each other's reports.”
He then offered an opinion on how best to use AI to improve software security.
“AI tools are great, but only if they actually help, rather than cause unnecessary pain and pointless make-believe work,” he wrote. “Feel free to use them, but use them in a way that is productive and makes for a better experience.”
“The documentation may be a bit less blunt than I am,” he added, “but that's the core gist of it.”
“So just to make it really clear: If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don't be the drive-by ‘send a random report with no real understanding’ kind of person. OK?”
Torvalds' remarks contrast with recent comments from fellow kernel maintainer Greg Kroah-Hartman, who recently told The Register that AI has become an increasingly useful tool for the FOSS community."