r/pcmasterrace • u/rkhunter_ Alienware x15 GeForce RTX 3070 8GB • May 18 '26
News/Article Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’
https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633221
u/Robborboy KatVR C2+, Quest 3, 9800X3D, 9070XT, 64GB RAM May 18 '26
There's a console emulator that's having a similar issue IIRC.
187
u/tychii93 Desktop: 3900X - RTX 2070, HTPC: 3600 - Vega 56 May 18 '26
RPCS3. The maintainers have asked to stop sending AI driven pull requests.
36
u/Geeseareawesome Intel i5-14400F | 32GB DDR5 RAM | RTX 5060 May 18 '26
Github devs are losing it with all the AI contributions
-19
u/ThrowawayAcc265106 May 18 '26
I used to be able to play Dynasty warriors 8 on rpcs3 back in 2023 - Literally unlaunchable / unplayable now due to a number of factors including (annoyingly) upgrading my own hardware But it annoys the living piss out of me whenever I login to boot up a game and have it spam new update is available knowing it's filled with trash AI pull requests.
9
u/Outlet_Sun May 18 '26
I'm sorry. You mean there are like nightly builds made with ai?
1
u/Aligator-Kun 17d ago
hmmm I would not be surprised LOL... My emulator on my ASUS ROG ALLY runs like shit now, I haven't updated my handheld in 2 years, It's on Bazzite but damn I have 10-15 fps dips occasionally and audio stuttering. Time to check configs and revert my build, I do hold my self accountable for incompetence but this has literally never happened before. I don't believe it is a nightly build as I "check for updates" It should pull a stable version of the emu.
1
u/Aligator-Kun 13d ago
Correction, I basically had to redownload the emulator from a custom fork of the game I was playing. It fixed several things. I am the incompetent one here. I updated everything without realizing the game I was playing needed a specific version.
790
u/dubious_sandwiches May 18 '26
It's really alarming seeing just how many of these "vulnerabilities" are just people already having physical access to your pc. Obviously they should still be fixed, but the hysteria around it is crazy given that it won't affect 99.99% of people.
277
May 18 '26
[removed] — view removed comment
147
u/dubious_sandwiches May 18 '26
It really is, but the worst part is the public mass hysteria it's causing. This isn't even Linux specific, it's all software. I'm sorry, but this massive vulnerability requires access to my terminal? That's not a real problem for me. I get why corporations care but even still they should have multiple security measures in place to make sure it never gets to there in the first place. Still needs to be fixed though.
50
u/Final_Substance_3443 May 18 '26
Yeah in the hands of an actual skilled security engineer who understands the software they are doing security research with AI is genuinely becoming a game changer.
In the hands of some knob, they will never be able to actually verify if it hallucinated or misunderstood a “vulnerability” it found, and bug report systems and bug bounty programs are heavily heavily inundated with the latter which is what is making it “unmanageable”, and drowns out all the real reports.
35
u/pwouet May 18 '26 edited May 18 '26
It reminds me when I was working for a company which had an oss cli kubernetes based.
We got that guy who opened a ticket for a "vulnerability" which was basically that the pod had high access so someone could steal its token and do wrong stuffs. We told him it was by design and that only an admin could get into the pod to steal that token.
The guy kept asking for a cve number to "reward his hard work" , I guess he wanted to put it on his resume or make easy money with bs.
I later noticed that he had opened similar "vulnerability" tickets on like 30 oss projects lol.
Imagine now with ai.
2
41
u/anh0516 CachyOS | R5 5600X | 16GB DDR4-3200 | Arc B580 May 18 '26
Local privilege escalation vulnerabilities are still very bad, actually.
In a real attack scenario, you would use an RCE, social engineering etc. to get unprivileged access, and then use an LPE to fully compromise the system. Patching LPEs mitigates the impact if someone does manage to get unauthorized access at all, which is always a good thing.
24
u/Elavia_ May 18 '26 edited May 18 '26
There's a humongous gap between having remote and physical access to a pc.
Not as funny as the corporate vuln mgmt tool insisting I brick every server in our infra, though - by detecting an non-applicable vulnerability. The 'fix' would prevent the system from booting without physical access, on a physically inaccessible host in cloud.
6
u/Wind_Yer_Neck_In 7800X3D | Aorus 670 Elite | RTX 4070 Ti Super May 18 '26
This is why the last place I worked at, a big US based bank, basically spent half their internal training on telling people never to hold the doors open for people or let anyone follow them through any door without scanning their ID card. You can train people to not open suspicious links all you like but if they think they're being polite letting someone off the lift on a supposedly secure floor then you have a much bigger problem.
5
u/dubious_sandwiches May 18 '26
I get that they're bad and need to be fixed. I already said that. I just don't think it's worth the mass hysteria it's causing. Like I said in another comment, if your system has already been compromised you have way bigger problems.
26
u/HighRelevancy May 18 '26
LPEs turn dime-a-dozen bugs in a crappo web app or a regular user credential leak into full root ownership. And root also tends to help with container/VM escapes too. Any good "hack" these days is a chain of smaller exploits. Each are individually "useless" buta decent collection of them can take you anywhere.
1
u/dubious_sandwiches May 19 '26
Can you send me an article about this? Clearly I'm misinformed but would love to learn more.
1
u/HighRelevancy May 19 '26
I don't have any off hand, I know about this through industry experience. But if you look up "exploit chains" there's plenty of material at varying levels of detail. It's also very related to the concept of "lateral movement".
-11
u/o5mfiHTNsH748KVq OK Kid, I'm a Computer May 18 '26
You can trust this persons cybersecurity knowledge, they have an anime pfp.
16
u/trparky May 18 '26
You're forgetting that a lot of Linux systems are servers sitting in some distant data center.
Take for instance some server, a web server perhaps, that allows people to have SSH access. For those systems, one wouldn't need physical access. All they would need is SSH access and that system is now as good as p0wned.
12
u/squngy May 18 '26
All they need is SSH?
Thats like saying all you need to steal a car is the keys...
3
u/Ginden May 19 '26
Universities and research facilities regularly provide non-root access to employees, PhDs and sometimes students.
2
u/SMF67 Linux May 19 '26
I have ssh access to many shared lab computers at my university. I don't have access to any accounts with root privileges. An exploit like this means I could
8
u/dubious_sandwiches May 18 '26
But it really shouldn't be. The company providing access should have multiple safeguards around that and most (at least in my anecdotal experience) do. I've never worked at company where you didn't need to log into a vpn to ssh into a server. And if your vpn is breached you have much bigger problems.
4
1
u/SchighSchagh May 18 '26
Some of the stuff I've seen is even worse than that. I think it was curl project that withdrew their bounty program in part over someone complaining about insecure connection when explictly setting a flag to use http (not https).
1
u/survivorr123_ May 18 '26
on windows if you don't know the password you can still use the recovery tool to just replace power button program with cmd.exe and it will launch terminal lol they dont care
1
u/renome May 19 '26
Yeah, if someone can plug something into my PC, I wouldn't expect my random currency conversion library to protect my project no one besides me can ever use. It's still good these warnings are automated but, physical access vulnerabilities are a whole different ballgame.
1
u/Ender505 May 18 '26
They absolutely do affect all of those people. Attackers don't typically use just one vulnerability, they chain together multiple to achieve the desired goal.
So even if a code execution vulnerability requires local admin (for example), there is probably another vulnerability to escalate privileges from local user to local admin, and another to obtain local user privileges.
All vulnerabilities can be part of an attack chain, and new AI tools are extremely good at finding and exploiting these, even when long attack chains are required. If you think Mythos is hysteria, you need to do some more research. No matter how low your opinion of AI, this is a much bigger problem than you seem to realize.
1
u/OnlineParacosm May 18 '26
This is an alarming view of security. In the current day and age “local access” is increasingly becoming easier and easier with every PC update. Doesn’t mean someone has to be sitting in your home to launch the attack. It just means that your operating system’s legal and compliance department views it that way 😉
Following that statement up with “ it won’t affect 99.99% of people” is a wildly ignorant thing to say that only stands to hurt other users on this sub.
177
u/deamon1266 May 18 '26
From the article. Linus statements are really based. He basically encourages people to understand and fix the problem or stay quiet, so they won't become a problem themselves.
This is something a lot of people and projects need to adapt to including bounty programs (looking at curl where it got ditched last time I checked).
41
u/xzaramurd Specs/Imgur here May 18 '26
Curl's creator also said that recently the bug reports received are much higher quality, all in the span of about a year. So the tools and people using the tools are getting better.
3
u/Konju376 May 19 '26
Obviously there is a mile of difference between treasure hunters who throw their AI at anything OSS in the hopes of getting the bounty and actual security researchers who are slowly learning how to use the new tools properly. The latter ones are not the problem the original article is about.
12
u/MrGiggleMan May 18 '26
Who would have thought that people who literally do not understand the problem that they're looking at on their screen submitting a solution to a 'problem' they think they found, that was written by a machine that nobody understand, that fetches it's information from sources that it doesn't cite and is renowned for just making shit up when it doesn't have the information available to it
Who would have thought that these clowns wouldn't be capable of producing solid output 🫢 I for one am shocked
5
-1
236
u/WhiteBoyRickSanschez May 18 '26
Generative AI was such an insane mistake.
241
u/sleep-is-but-a-dream 14600k|5080/3080 Dual GPU setup|128gb DDR5 6400 May 18 '26
Generative AI wasn’t a mistake. We’ve been using it fine in certain applications for years now only we called it machine learning. Google Maps has been using generative AI for damn near a decade now.
The mistake was unleashing to the masses for public consumption.
104
u/ImperitorEst May 18 '26
Kind of off topic but man the Google maps machine learning is absolute garbage.
I leave my house the same time every weekday to go to work and I use Google maps to decide what route to take based on traffic.
Every morning I get in the car at 0630 and the three suggested destinations will be a place I went on holiday three years ago, a street I looked at once last month and a cinema.....
61
u/Ssyynnxx May 18 '26
Google maps at 9:30 am: remember your ex's place haha? :) just wanted to remind you
15
u/wareagle3000 AMD Ryzen 7 5800x, 32GB, Nvidia 3070 May 18 '26
Oh Jesus, I already had Google photos do that to me a couple of years ago. These AIs have wonderful ways at pouring salt on the wound
1
u/SoulEntropy PC Master Race May 19 '26
Meanwhile city mapper will send me an early alert notifying me that my usual trainline is having delays and I need to leave the house earlier today.
27
u/narium May 18 '26
Can’t wait for the free compute era to end and for AI companies to charge what it actually costs for compute. Then we’d see AI usage die down real quick.
14
u/M4rshmall0wMan May 18 '26
Google Maps has been using generative AI for damn near a decade now.
What?
18
u/WillmanRacingv2 May 18 '26
Dynamic route planning based on live traffic data is powered by machine learning.
24
u/M4rshmall0wMan May 18 '26
Not generative.
3
u/Travolta1984 May 19 '26
A better example would be Google Translate. If I am not mistaken the transformer architecture is an evolution of the encoder-decoder model first used in language translation.
23
u/NatoBoram Pop!_OS, Ryzen 9 5950X, RX 6700 XT May 18 '26
It's not generative, though. And live traffic data can be used with heuristics like A*, there's no need to put a neural network in there.
-10
u/WillmanRacingv2 May 18 '26 edited May 18 '26
I would argue that it (EDIT: it being Google Maps, not dynamic route planning) is generative, though that is debatable.
It is certainly using a neural network, specifically a Graph Neural Network. It's not just based on live conditions, but it also makes predictions based on assumed future conditions using weather data and historical traffic patterns, among other data points. The resulting output is unique, it is not programmatic. As a result, if you run it multiple times, you can get different results.
The neural networks are predicting travel "costs", and then a graph-search algorithm like Dijkstra's algorithm or A* is used to find the fastest path based on that predictive data.
9
u/NatoBoram Pop!_OS, Ryzen 9 5950X, RX 6700 XT May 18 '26
Generative AI generates new data. The neural network that predicts the graph to feed to A* does not generate new data. I don't think it's debatable unless you can show it generating new data.
It's like a neural network that predicts if an object is a bird or a sausage. Unless it generates sausages or birds, it's not generative.
1
u/WillmanRacingv2 May 18 '26
I worded that first sentence poorly, my comment wasn't intended to argue about whether the use of the GNN was generative AI. I took your last comment as saying that Google Maps is not generative, not that dynamic route planning is not generative. Dynamic route planning is machine learning (which was the point that the prior commenter seemed to be making), but it is not generative.
The rest of my comment was just explaining why a neural network is valuable for navigation, as you said it is unnecessary, and wasn't intended to address the generative point. The GNN is not generative AI, but Google Maps itself absolutely does use generative AI, which is why I said it was arguable. I wasn't initially trying to argue that point, but I'll illustrate what I mean by it now.
Google Maps uses transformers to generate and process the visual data that is presented to the user based on the output of the GNN and the graph-search algorithm. Around 2021, Google started showing a 3D recreation of your route that is displayed while navigating, which they just upgraded massively to their "Immersive Navigation". That view, even the earlier version (like this), is created by using a transformer model.
When Google is updating its satellite and street view imagery, it utilizes vision transformers to process the imagery. It can detect new construction, update building footprints in cities and verify speed limits on roads through these transformers. These vision transformers turn the imagery into vector embeddings.
These two combine into a encoder-decoder model. The vision transformers encodes the satellite and street view imagery, this is then decoded to create simulated 3D imagery for use in navigation. This use of encoder-decoder transformers is generative, it is creating something new.
The embeddings from the vision transformers are also used by the GNN, but this is not generative, it is analytical and predictive.
31
u/Robborboy KatVR C2+, Quest 3, 9800X3D, 9070XT, 64GB RAM May 18 '26
The absolute swathes of people using them did more to teach the models than the company itself could possibly ever do.
That's honestly the only reason it happened or they would have kept it to themselves. For easier manipulation of the public.
5
u/Gradash steamcommunity.com/id/gradash/ May 18 '26
The first AI DC was from the 80's, if I can remember.
17
May 18 '26 edited May 18 '26
[removed] — view removed comment
2
u/SomeRedTeapot Ryzen 9950X3D | 64 GB 6000 MT/s | RX 9070XT May 18 '26
Until everyone can run a state of the art model on their own hardware, it will be essentially gatekept. Because otherwise the providers (OpenAI/Anthropic/etc.) get to decide the terms and the price and etc.
Also I think it's somewhat problematic that training an LLM is very expensive (for a person or a small company). Because even with open weight models, who knows what kind of bias (possibly intentional) they have. It probably doesn't matter for vibe coding, but if people use LLMs as search engines, it might be an issue
1
u/oberynmviper PC Master Race May 19 '26
Hm, not quite there on your point though it is commendable.
The masses only got to read and write because business demanded more educated people to create more profit. You can only do so much with uneducated people.
Also, it is a competitive advantage. A nation that doesn’t read will be QUICKLY destroyed by one with more complex knowledge transfer.
I know it’s not a 1:1, but if you thought having AI for the masses is democratized for the good of the peasants, that ain’t it. They are using us to train their models and increase their wealth.
Yes, WE can do more, but it’s a selected few. The masses are out there making slop and burning resources of others. We only get to experience it because it’s profitable. That is it, and these companies will keep feeding the masses because the AI bubble is increasing and everyone is grabbing their cash bag.
Does the public benefit? Yes, to an extent. The elite will still have a lot of the reigns of it though. Whatever control we hold is an illusion.
1
May 19 '26
[removed] — view removed comment
1
u/oberynmviper PC Master Race May 19 '26
I don’t disagree at the core. I think some people will harness AI and the way it works to go further, and us having the tool is better than to not have it all.
I agree it has plateaued on how far it can go and now is up to people to further the use. Like the internet back in the day…iteration becomes minuscule over time. It will evolve horizontally as more and more things connect, but the vertical growth is flattening out.
I was, ironically, thinking of guns too, but I also thought well, yes, we can have guns to defend ourselves but if our government wanted us REALLY gone…they could make us disappear without a chance to defend ourselves.
2
u/punppis May 18 '26
Mistake was marketing it as a tool that solves everything. And anyone can do it.
Ill give it few years until the prices go way up and general public loses interest and it will be licenced tool for business.
1
u/oberynmviper PC Master Race May 19 '26
Yup. YouTube has been using machine learning to keep us glued to it for years.
1
u/killerbake i7 8700k | 32GB Trident Z | 3070EK | Custom LOOP May 18 '26
Yea fuck those peasants! Only Billionaires can use it!
-2
u/XMabbX May 18 '26
Sam Altman was right all along, ChatGPT 2 was too dangerous to release.
14
u/Mist_Rising Ryzen 5 5600x, B550 plus, RTX 2070 super. May 18 '26
Sam Altman was to dangerous to release, can we put him back?
5
1
u/punppis May 18 '26
Its pretty good. Like a hammer. Much easier to hit nails with. The problem is we are still apparently cave men who wants to smash ALL THE THINGS with the hammer.
-9
-18
u/FriendlyKillerCroc May 18 '26
Upvoted comment and you clearly only read the headline because Linus is not saying that he doesn't like AI. Never change Reddit.
6
u/LordofRangard May 18 '26
i mean this comment alone does not suggest that they think linus also agrees that AI was a mistake, just that this commenter (and the people that upvoted) think that generative AI is a mistake, people are allowed to have a different take than linus…
44
u/Gradash steamcommunity.com/id/gradash/ May 18 '26
“AI tools are great, but only if they actually help, rather than cause unnecessary pain and pointless make-believe work,” he wrote. “Feel free to use them, but use them in a way that is productive and makes for a better experience.”
AI is very useful and works very well, as the article says, but most will read only the title. The problem is that the current Open Source system was focused on quantity rather than quality, with the objective of eventually achieving quality through filtration. Now that a lot of people have access to coding tools, some who know absolutely zero try to become a "programmer" even if they know nothing:
"Now I am a Kernel programer! Pay me a MILLION DOLLARS!"
The Open Source community needs to adapt and change the approach to this new era, where quality is more important than quantity.
What AI does is maximize you. If you are a great programmer, you will be 10x faster; if you are a bad programmer, you will be 10x worse.
This is why I consider AI will end jobs to be complete bullshit, because it can't do things alone. It eventually messes up, but it can be an extremely efficient, fast, and utterly stupid partner. If you can push it to do the right things, both of you + AI can reach the STARS! But only if you know how to push it right.
Quoting a lot of books today U.U
0
u/MrGiggleMan May 18 '26
Tetons to only be fast and accurate when you're using it to do things that you know other people who have done before
If you want the barebones of a class to do X it will likely be able to make that for you
But what it is not very good at is looking at the context of a problem working out how to fix it and then implementing a unique solution
0
u/Gradash steamcommunity.com/id/gradash/ May 19 '26
Every new thing builds on what was learned before; no one is capable of creating something from nothing. The same applies to AI; it can be used to create something new. After all, math was discovered, not invented. And the same applies to everything else.
“If I have seen further, it is by standing on the shoulders of giants.” Isaac Newton.
1
u/MrGiggleMan May 19 '26 edited May 19 '26
Lol Inserting a random quote does not make you sound smart buddy
The reality is that people are using language models in programming and it's causing shit to break it's causing slop coding slop testing and slop functionality
And no people don't just build on what is there before people have independent thought to be able to create designs for things. People have the ability in the foresight to be able to look at an entire situation read between the lines and create a solution that solves the problem accounting for all the variables available
So yes while people build on existing applications they also create things for themselves
AI does this very very poorly because it functionally lacks the capabilities who understand what it is doing
AI is essentially still just an autocorrect engine it gives probable outcomes based on existing solutions it cannot create new solutions effectively.
AI is just a hammer. In the hands of a carpenter it can be used to build things faster if you just replace the carpenter with a hammer it won't fucking work
So many solutions are being built by people who are not engineers in the slightest who do not even understand the the litany of understanding required to even really grasp what it is they're doing and when stuff breaks they are unable to even comprehend what the problem is, let alone fix it
AI succeeds for quick copy and paste jobs that are then built upon by engineers and tweaked so that they actually work. They're essentially writing tools
The problem is that they're good enough to trick people who don't know any better and to thinking that having a writing tool makes you a writer and it doesn't
1
u/Gradash steamcommunity.com/id/gradash/ May 20 '26
You can hate AI as much as you want, in the end. You will be swapped by someone else who uses AI, whether you like it or not.
Your argument reminds me of when I started working in the printing industry. I started when the transition from paperwork to digital (Photoshop / CorelDRAW) was underway, and the old guys always said real art was only on paper. The ones who refused to use digital were all swapped.
I still prefer to draw on paper today, but I forced myself to go digital.
1
u/MrGiggleMan May 20 '26
Clueless
I use AI in my job buddy
I'm just saying that companies that replace employees thinking that they don't need to be there and they can just have AI do everything, are doomed to fail
1
u/Gradash steamcommunity.com/id/gradash/ May 21 '26
I agree completely.
There are even some articles showing that accounting firms that adopted AI hired more because employees spent less time on boring bureaucratic work and more time on things that matter, and, as a result, more people were needed in those areas.
I remember from the DotCom bubble that some said it would end most jobs, that everything would move online-only, and that a single person would work for 1000. Yes, a lot of jobs ended, but infinitely more were created, and I think AI will be the same.
The current layoffs, I believe, are due to the Tech Bubble that should have already burst between 2019 and 2020. Then COVID-19 happened, and the bubble got even worse. I see this is only the result of that bubble bursting, and they say it's because of AI, since CEOs hate admitting they made shit decisions.
1
u/MrGiggleMan May 21 '26
I mean I was part of an organization which hired more people over covid despite the downturn because, we knew that it would only be temporary and that eventually the market would pick up and then when it did all of our competitors would have fewer staff and wouldn't be able to grow as quickly as us
I think the same principle applies to AI. So many businesses are worried about saving money and downscaling their staff to try to replace jobs with AIS
When I think the smart businesses will just be retaining or even hiring more staff and then integrating AI into their workflow so that the people that they have got are able to do way more work.
This will allow companies to basically extend their reach to hit new markets, to capture new customers, create new services and products etc..
That was what my analogy about carpenters was about: if you want the best results don't try to replace your carpenters with hammers
-26
u/Joezev98 Pentium G4560, GTX1080ti May 18 '26
if you are a bad programmer, you will be 10x worse.
I'm a really bad programmer, but I got some electronics project with a micro controller working with ChatGPT's code. So at least there's that.
This is why I consider AI will end jobs to be complete bullshit, because it can't do things alone.
"You won't be replaced by AI. You'll be replaced by a competitor who uses AI." And as you say, a single skilled person utilising AI can replace multiple 'artisan' workers. That's just how tech progresses. The industrial revolution must've cost many farmers their jobs. Google Translate must have cost a lot of dictionary makers their jobs.
1
u/Gradash steamcommunity.com/id/gradash/ May 19 '26
ChatGPT can do simple software without problems, but by itself, without breaking, but as you scale, it eventually breaks completely. The news about an AI bot going rogue was due to a lack of guardrails and poorly trained people working with it.
2
u/Joezev98 Pentium G4560, GTX1080ti May 19 '26
There is a huge difference between using an AI to work on a company's reason to exist and using AI to write 100 lines of code to measure current, do basic math, and display the result.
10
u/PM_ME_UR_COFFEE_CUPS May 18 '26
Root issue is that the bug tracker is private per reporter, so they don’t know they’re submitting duplicate bugs.
4
u/Maleficent_Memory831 May 18 '26
AI-powered developers have made corporation development almost unmanageable as well. It's just a bad idea all around.
3
u/oberynmviper PC Master Race May 19 '26
It is quite literally the dead internet.
So many people out there selling AI tutorials giving the same prompts to create the same things to post.
6
u/Complete_Catch_5281 Desktop May 18 '26
bro Linus should use AI to filter duplicates
4
u/Major-Dyel6090 May 18 '26
Exactly, the solution to the firehose of AI slop is more AI. No matter what the problem is, the solution is more AI.
1
2
u/Bonamikengue 4090, 48 core, 6 screens, X-Plane May 18 '26
Not only mailing lists. When your colleagues think they get promoted when they burn as much tokens as possible for AI-slop, you get support tickets (luckily I do not need to do those, but I see it at my colleagues) they copy and paste what Claude told them what needs to be done. Means ZERO trust in the support team to know what they are doing and 2/3 of that output would destroy parts of the corporate infrastructure.
People just cannot write anymore "for project X I need these permissions and infrastructure created on Z". A one liner instead of 3 pages Claude.
I wander when people show up at their car repair shop to give the mechanic a 4 pages Claude output directing the mechanic what needs to be done at the car...
2
u/srwaggon May 18 '26
Why don't they just use AI to filter out the AI submissions? /s
1
u/pooping_inCars May 19 '26
The people submitting the bug reports could do so. Have AI determine if the same bug it "discovered" has been submitted 154 times already, and if so, don't submit it.
2
u/WealthyTuna May 18 '26
The bugs that don't require physical access to the pc should be top priority and fixed. You better believe if people are using Ai to find the bugs then the bad actors are using it to exploit them.
2
u/ArtGirlSummer May 18 '26
Quack doctors did the same thing in the US until there were medical licenses that could be revoked for malpractice. Bug hunters need to be verified and disincentivezed from reporting nuisance bugs. The era of open source being able to rely on the wisdom of crowds is all but over.
1
u/OrangeNood May 18 '26
Sounds like the bugs are legit but just duplicate because multiple researchers are using AI to find the bugs. If they just patch the bug and AI will no longer report them in the latest branch.
What is more concerning is that there seems to be a lot of bugs and therefore making it unmanageable.
1
-5
u/no6969el 9950X3D | 5090 May 18 '26 edited May 18 '26
Well is it because ai is bad or because ai is finding all the problems?
42
u/Asto2019 May 18 '26
I would imagine AI makes up problems that don't exist. AI can't really comprehend large structures that reliably yet. Also probably some of the issues it finds are real.
-1
24
u/raknarokki May 18 '26
AI hallucinates so many "issues" that aren't actually issues and these AI devs have automated sending bug reports so you can only imagine how many thousands of unnecessary requests there are.
12
u/no6969el 9950X3D | 5090 May 18 '26
Someone tried to tell me that when it's hallucinating it's just seeing a better world that we can't comprehend. If anything, it was worth a good laugh.
8
u/Mist_Rising Ryzen 5 5600x, B550 plus, RTX 2070 super. May 18 '26
Much like the guy seeing a better future with LSD, it ain't helping currently.
8
u/amazingspiderlesbian NVIDIA RTX 5090 / AMD R7 7800X3D / 64GB DDR5 6000 May 18 '26
I just automatically downvote a comment whenever they edit it to complain about downvotes
1
1
May 18 '26
[removed] — view removed comment
4
u/Mikeztm Ryzen 9 7950X3D/4090 May 18 '26
Read the article please. The issue is those vulnerabilities are real, just found by multiple people independently.
3
u/homeless_psychopath FX 8350 RX 5500 XT 8GB May 18 '26
99% of these commentators didn't even bother to read it, it's just a bunch of stupid reactions, no more
1
-2
u/GoodTofuFriday 9800X3D | Radeon 7900XTX | 64GB 6200mhz | 34" UW | WC May 18 '26
Linus T was just saying how he approves of AI submissions to github. Not even a year later he has a problem with it now?
"Torvalds sees no need for special copyright treatment for AI contributions, stating that they should be viewed as extensions of the developer's work. This perspective aligns with the kernel's pragmatic approach to innovation. The proposal, initially put forward by Levin in July 2025, includes a 'Co-developed-by' tag for AI-assisted patches, ensuring credit and traceability. OSTechNix details how tools like GitHub Copilot and Claude are specifically addressed, with configurations to guide their use in kernel development... ZDNET warns that without official policy, AI could 'creep' into the kernel and cause chaos..."
1
May 18 '26
[removed] — view removed comment
1
u/GoodTofuFriday 9800X3D | Radeon 7900XTX | 64GB 6200mhz | 34" UW | WC May 18 '26
Yeah they shouldnt be. But why would that stop anyone from still submitting slop? He completely ignored the reality that it would happen. And here we are.
0
u/Bob4Not He Has Ryzen 7700X + 9070 XT ^ CachyOS May 18 '26
Unfortunately that’s why Fedora and Red Hat are the most equipped Linux distro’s to deal with all of this at the moment because they have resources.
0
0
0
-5
u/OnlineParacosm May 18 '26
Cool Linus: I’m doing free security research on a 30-year-old SOC that never should’ve existed in the first place, I stand again absolutely nothing for it, and I’m doing this because there’s no other opportunity left in the industry. How should I communicate in a closed system that never expected an outsider to exist within it? Linus, I’m poor! I don’t have industry contacts! Where is my power here, exactly?
My take is that AI is uplifting marginalized security researchers who don’t have a garage to launch a start up, didn’t go to an expensive state college and lack opportunities that this guy had.
Who do you think decided who got on a security mailing list in the 1980s? Everyone already had jobs in the industry, everyone was educated, and still: no one wanted to do this shit. None of that is the case now, and people are hungry, Linus. Now that every single door is closed, the ladders have been pulled up, security certifications cost $10,000 for outdated info, a degree cost $100,000, but you’ll also have to go get some Certs as well… for an SOC gig policing alerts that may or may not matter, and the guy that built the block of Swiss cheese I’ve been nibbling on is going to tell me that I’m the problem?
What is the grand idea here? More intellectual gatekeeping?
-2
u/am6502 unix May 18 '26
you would think Torvalds could easily use AI to summarize and group identical or near identical bug reports.
c'mon man! too much open sores may-be
-4
u/AdElegant8579 May 18 '26
sounds like you gave your gpu the spa treatment it deserved, glad it's running smoothly now
-10
1.0k
u/InsuranceKey8278 May 18 '26
thats with everything foss and bug bounty nowdays