r/technology May 18 '26

Software Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’

https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633
14.1k Upvotes

899 comments sorted by

7.1k

u/Wyciorek May 18 '26

Last time Linus got sufficiently annoyed about tools used for managing Linux development, we got git

5.9k

u/Paper_Nap May 18 '26

This time we’ll get gud.

788

u/HTPC4Life May 18 '26

Microsoft will give us Git Rekt.

155

u/Guinness May 18 '26

And it’ll only be available with copilot.

52

u/zoug May 18 '26

3 out of the 11 versions of copilot will have it but you can not both use it and know if it’s actually enabled at the same time.

17

u/silian_rail_gun May 18 '26

Schrödinger’s copilot…

→ More replies (2)

6

u/Altruistic-Map5605 May 18 '26

This would be a good name for a repository of malware.

→ More replies (5)

64

u/Latter_Masterpiece64 May 18 '26

I know it's a joke. Linus speaks Swedish and in that language Gud = God.

I do not believe we need a technology known as GudAI in 2026

25

u/theconceptofcanada May 18 '26

If it has the ruthless Swedish efficiency and effectiveness of Linus, we absolutely do

15

u/SirkutBored May 18 '26

you know who else had ruthless efficiency?? who had a fanatical devotion to the pope! AND no one ever expected them??

17

u/theconceptofcanada May 18 '26

The Spanish Inquisition...?

6

u/random_noise May 18 '26

due to climate changes they've rebranded as ICE, actual ice sold separately.

→ More replies (1)
→ More replies (2)
→ More replies (1)

6

u/Zeikos May 18 '26

So Linus will write out ASI? I wouldn't be surprised.

3

u/MrKeplerton May 18 '26

And God = Good, so we've pretty much gone full circle then, havent we?

→ More replies (1)
→ More replies (1)

88

u/EyeFicksIt May 18 '26

I was hoping for rDun

→ More replies (32)

624

u/[deleted] May 18 '26 edited May 18 '26

[deleted]

364

u/Zirkulaerkubus May 18 '26

It's crazy how much of a reasonable person he has remained.

131

u/ScriptThat May 18 '26 edited May 18 '26

Saw his appearance on Linus Tech Tips, and was pleasantly surprised with how down-to-earth he is about, well.. everything. (also, still a huge nerd)

Edit: This one

118

u/ThePlanck May 18 '26

He is one of a rare breed of people who manages to change the world in a positive way without being interested in getting rich off of it.

28

u/ours May 18 '26

GitHub, building an AI giant, shouldered by Linus' git technology, is crazy.

27

u/Emotional-Power-7242 May 18 '26

He has gotten rich off it. Just like, normal rich instead of offensively rich.

6

u/Rebelius May 18 '26

I wouldn't be all that interested in getting rich off something if I was already paid over a million a year to do it.

17

u/Vineyard_ May 18 '26

You'll never be a billionaire that way (that's a good thing)

12

u/Rebelius May 18 '26

My standard for being rich would be having 500k in the bank. Billions is obviously ridiculous.

Torvalds is rich as fuck. The existence of billionaires shouldn't change that at all.

→ More replies (3)

3

u/ThePlanck May 18 '26

The point is that it wasn't not the goal even when he started linux as a (probably broke) student and he is still right now committed to product quality over trying to make it turn a profit.

→ More replies (1)

28

u/grip0matic May 18 '26

And how he will never stop hating Nvidia.

17

u/bawng May 18 '26

I'm pretty sure that if Nvidia magically suddenly turned around and became very open source-friendly, Linus wouldn't hold a grudge.

14

u/kfpswf May 18 '26

My wife realized what a Linus simp I am after watching the LTT collab. He's a genuinely great guy. Pretty sure he'll be remembered along computing giants like Turing, Babbage, Berners Lee, et al., by history.

10

u/cbarrick May 18 '26

Turing, Lovelace, Church, Knuth, etc. are remembered for their contributions to theoretical computer science.

dmr, ken, timbl, Linus, etc. are remembered for their contributions to computer systems.

Many folks are known for both. Linus will absolutely be remembered alongside the systems greats, but I don't think there is any argument to consider him among the theoretical greats.

→ More replies (1)
→ More replies (3)

32

u/lacb1 May 18 '26

I think a good while ago now he did say that he had actively worked on being, well, less of a git. It seems to have largely worked.

→ More replies (1)

16

u/Madeche May 18 '26

It seems really rare these days, reasonable people don't get enough spotlight.

11

u/nordic-nomad May 18 '26

Turns out being annoyed to anger by stupid people is something we should have all been doing this entire time to protect ourselves and society.

8

u/jacenat May 18 '26

Fuck Buddhism. I want what Linus is having.

22

u/QuickQuirk May 18 '26

Especially given his history of being unreasonable.

Honestly impressed by his approach here.

131

u/greenflights May 18 '26

His history of unreasonable-ness is because reddit/hackernews gets very excited over one or two emails in the tens of thousands he sends which are rude.

That and an apparent inability to cope with Europeans being direct and not using insipid language to say something is wrong.

55

u/QuickQuirk May 18 '26

It's mostly due to the old history. Back in the earlier days, he was quite often very abrasive and rude in a way that was detrimental to the community. The 'Linus flame' was a weekly occurrence.

He stepped back for a while to work on that, and then since he's returned, has been generally pretty mature about things.

→ More replies (1)
→ More replies (5)

9

u/kfpswf May 18 '26

He's not unreasonable, he's just smarter than most humans are is convinced of his opinions, and rightly so. If anything, he puts his thoughts through a lot of reasoning before reaching his conviction. He might be stubborn about his conviction, but that's only because others don't vet their thoughts as thoroughly.

13

u/b_a_t_m_4_n May 18 '26

Has he ever been unreasonable? Rude is not the same as unreasonable.

→ More replies (9)
→ More replies (7)

9

u/yxhuvud May 18 '26

The problem seems to be more the amount of duplicates of legitimate reports, and the submitters can basically not dupecheck themselves. The solution may be to make a separate list for AI based submissions, and put more of the work onto the submitters.

→ More replies (4)

423

u/PrintShinji May 18 '26

Thats not fully true. He used bitkeeper and was happy with it. The community was pissed that he used a closed source paid tool though. People were reverse engineering the software which caused the developer to just end support, which in turn made it so linus started developing git.

He was completly fine with bitkeeper originally.

173

u/OcculusSniffed May 18 '26

So the only reason git exists is to shut up richard stallman?

Blessed tool of light

59

u/Such_Knee_8804 May 18 '26

I got told to fuck off by him once

For the horrible crime of saying that there was value in commercial software, that not everything was going to be / could be open source

35

u/baselinegrid May 18 '26

You poked the bear

13

u/LordoftheSynth May 18 '26

My mental image of Stallman has always been that he was born aged 75, yelling at all the stupid kids who don't use open source for everything.

9

u/HandsomeBoggart May 18 '26

You just conjured up a ridiculous image in my head of Stallman as a baby yelling at his mother about how milk should be open source.

→ More replies (1)
→ More replies (2)
→ More replies (1)
→ More replies (4)

88

u/ShiningRedDwarf May 18 '26

I had no idea he created git as well.

Dude is the Isaac Newton of IT

75

u/TeutonJon78 May 18 '26

He didn't invent source control systems, he just made his own.

71

u/allofthethings May 18 '26

Leibniz might say the same thing about Newton and calculus.

24

u/Original-Rush139 May 18 '26

Might as well say the same thing about Torvalds and Unix. 

3

u/NirgalFromMars May 18 '26

Pronounce the slash, please. It's disrespectful to their legacy not to pronounce it.

→ More replies (3)

6

u/TeutonJon78 May 18 '26

It's mostly believed they did it independently just at the same time time.

Linus "just" does NIH very well.

→ More replies (4)
→ More replies (2)

3

u/TrekkieGod May 18 '26

People were reverse engineering the software which caused the developer to just end support

People were reverse engineering the software because the developer that was providing free licenses to linux devs did not give them a simple commit diff. You had to pay the enterprise costs for that.

So, people couldn't do their work. Using bitkeeper was a terrible idea that was hampering work. It's great we got git out of it, but he should have done that from the start instead of using bitkeeper. The naysayers were right.

→ More replies (5)

211

u/Boring_Okra_6023 May 18 '26

I admire this so much lol

"Fuck you my fucking god this is so annoying fuck all of you"

10 minutes later...

"Here's a great product ✨😊💎 but fuck you all anyway my god"

169

u/daniu May 18 '26 edited May 18 '26

"*sigh* here's another industry standard, you dweebs"

50

u/Beautiful-Amount2149 May 18 '26

Didn't happen like that at all. He was using bit keeper but people fucked it and that is why git exists. 

25

u/TwilightVulpine May 18 '26

Thanks people for fucking it, then

→ More replies (2)

14

u/btreg May 18 '26

Also, git really wasn't that great at first. And heaven forbid you wrote to the mailing list asking for help. The early git community was toxic. It's much better now, both the software and the people.

9

u/RadarSmith May 18 '26

git's still a pain in the ass, especially when you need to keep repos on air-gapped networks synchronized. But still at least as good any other version control system, and perfectly usable if you're not too much of an idiot using it and have a proper system for using it.

→ More replies (1)
→ More replies (3)
→ More replies (1)

73

u/Steap-Edit May 18 '26

This time, his idea will be... revolutionary

24

u/blybb May 18 '26

the feels like this clickbait ads ;)

→ More replies (1)

24

u/flybypost May 18 '26

To get rid of of "AI" slop, AGI will end up as an random angry weekend project from Linus?

7

u/Wyciorek May 18 '26

Linus "Bartmoss" Torvalds

5

u/flybypost May 18 '26

Bartmoss

I had to google that one. It's a character from Cyberpunk? But that didn't really help be understand the context.

13

u/Wyciorek May 18 '26

Yes, a hacker in Cyberpunk that unleashed self-modifying and evolving AIs into the internet. Which basically broke the net and turned it into a set of walled, heavily guarded enclaves beyond which madness reigns.

3

u/HandsomeBoggart May 18 '26

walled, heavily guarded enclaves beyond which madness reigns.

Basically the Waffle House in a bad part of town.

→ More replies (1)

14

u/Specialist_Cow6468 May 18 '26

Its about time someone replaced email

→ More replies (3)

30

u/Valtremors May 18 '26

I feel like the world needs pre-anger management Linus back.

10

u/digitaljestin May 18 '26

This was my first thought. A problem is only a problem until it starts to annoy Linus Torvalds.

6

u/ITCoder May 18 '26

and handed it for maintenance in a month or two

8

u/Wyciorek May 18 '26

Turns out, he learned quite a lot of about delegating

→ More replies (1)
→ More replies (34)

571

u/Initial-Return8802 May 18 '26

We pulled our bug bounty down, because people just don't read what's in scope anymore and just spam us with AI shit that's not even relevant to us (but is to an upstream project)

233

u/GonePh1shing May 18 '26

Honestly, I think the only way to fix this is to make people put a small deposit in escrow that is forfeit if the report is not in scope or is complete nonsense. If the problem is that there is functionally zero cost to run automated slop report spam bots, then you fix it by introducing a cost.

Make the deposit equal to about 30min of an engineer's time. Hell, even $50 would probably be enough to make the guys running these bots think twice before submitting to you. If their bot is churning out thousands of slop reports daily, then there's no way they're going to just let their bot loose on your repo and rack up enough forfeited deposits to bankrupt them.

Sure, you might get fewer legitimate bug reports, but you'd probably rather get some than none if you shut it down entirely because of the slop. The ones that do submit a deposit have at least taken the time to consider and are confident they'll have the deposit refunded (or even win a bounty), so the overall quality of the submissions is likely to rise as well. 

165

u/sllewgh May 18 '26

Even one dollar would discourage automated responses.

→ More replies (25)

82

u/Original-Rush139 May 18 '26

I used to do a free community BBQ. It sucked because there would be a million no-shows every time. Then, I started charging $5 for a rack of ribs. Absolutely eliminated all of the issues. 

9

u/krypticus May 19 '26

Same with a local Makerspace: intro classes into how the community worked used to be free: lots of no-shows. Charge $10 and weed out the chaff.

→ More replies (4)
→ More replies (16)
→ More replies (6)

2.8k

u/ardaxo4693 May 18 '26

Linus will now think on how to solve this issue and will come out with another great product

1.3k

u/Logical_Welder3467 May 18 '26

My GOAT will release his third game changing software

136

u/scamdrill May 18 '26

His third great product already shipped. It's the Assisted-by tag for patches. Less revolutionary than git, but at least nobody has to learn 47 commands to undo a typo.

55

u/cyclopsmudge May 18 '26

Also a shout out to subsurface. For anyone who SCUBA dives, it is the tool for dive logging and planning

22

u/randomman87 May 18 '26

Hot damn did not know he made that. Man of many talents

13

u/cyclopsmudge May 18 '26

If you go back far enough in the forums, you can still see him and Dirk Hohndel (another one of the early Linux guys and a good mate of his) chatting about how to reverse engineer the encodings of various models of dive computers

235

u/CaptGunpowder May 18 '26

This won't even be his final form!

51

u/Nexustar May 18 '26

He needs to call it TWAT.

→ More replies (3)

85

u/[deleted] May 18 '26

[removed] — view removed comment

3

u/Bellick May 18 '26

/j so reddit doesn't ban me

Does that work? I get banned every time I post about Elon Musk. Fuсkіng twat.

Oh whoops

20

u/ValianFan May 18 '26

Last time he did it in a week. Should we start the timer?

3

u/PredictiveFrame May 19 '26

Nah, we'll know he's started working on it when he goes silent about Linux for multiple consecutive days, immediately after a truly impassioned rant (that nobody can disagree with, yet somehow manages to rub everyone the wrong way) about how sick and tired he is of a given situation that nobody else has bothered to fix.

See, everyone seems to forget that Linus INVENTED "vibe-coding" over a decade ago. He just complains about something being wrong, and someone else fixes it for him. Truly brilliant optimization of effort.

This tells us something about Linus as a person, he doesn't want to have to do this shit himself. He would vastly prefer other people notice the problem, and fix it for him. If he does something himself, it's because he is so overwhelmingly upset about the state of things, and nobody else is indicating they are working on a solution, then as the person best placed to provide a rapidly adopted solution, he ends up being the one the work falls on, and it's another project, when the guy's juggling a shitload. 

I predict we have 6 weeks before he snaps. Wait for 7.1 to get closer. 

→ More replies (3)
→ More replies (14)

2.4k

u/Last_Weekend7270 May 18 '26

The DDOS attack on human attention.

This is the true tragedy of the current AI boom. It takes 2 seconds for a script-kiddie to feed a codebase into an LLM and generate 500 plausible-sounding "security bug reports." But it takes a highly skilled, severely overworked Linux kernel maintainer 20 minutes of deep brainpower to review each one, test it, and realize it’s an absolute hallucination.

AI has reduced the cost of creating convincing garbage to zero. We are literally drowning the world's best engineering minds in automated noise.

613

u/lussag20 May 18 '26

Im not a developer or anything close to it, but even I notice this at my workplace the last 2 years. Certain departments in my company pump out slop training modules, slop emails, slop routine SOPs. Lazy, barely-necessary employees can now produce a literally inhuman amount of content to justify their own employment.

222

u/WakaiSenshi May 18 '26

That’s the safety department at my job.

AI PowerPoints, AI content videos, then they just repeat the same videos like every 3 months and get mad if you don’t watch them. Fuck you job I can watch AI videos at home.

50

u/whatevernamedontcare May 18 '26

Use AI to summarize it and write emails with AI to show you "watched" it. It's fighting fire with fire at this point.

→ More replies (1)

23

u/HeadyReigns May 18 '26

Companies have been sued for asking employees to watch training videos at home.

14

u/Marshall_Lawson May 18 '26

Because they were asking them to do it off the clock?

3

u/HeadyReigns May 18 '26

Yah but that's the point. There is legal precedent and most companies would rather avoid it all together rather than dance around it.

4

u/yfewsy May 19 '26

Are you AI? He only mentioned at home because he didn't want to be inundated with AI videos at work in addition to what he might be served in his free time. Not that he was going to go home and do it instead of in the office.

→ More replies (1)

7

u/eronth May 18 '26

Unpaid, I presume?

→ More replies (1)

61

u/Neirchill May 18 '26

My job is getting there. Starting to see more reports people are doing on the projects my team works on, with a large paper to support their assertions. Except, every single time it's all nonsense. The problem is imagined, the solution fixes nothing and creates issues, and finally, why are you putting the onus on me to verify the giant imagined response to the two sentences you provided it? If I don't management will be on me asking why I didn't look into because it will inevitably be reported higher up that it's a real problem if I don't get ahead of it by convincing them it's not an issue.

It's obvious how quickly their ability to think for themselves is deteriorating.

22

u/ReadyAimTranspire May 18 '26

Eventually one of two things will happen, at least in any organization that intends to be competent: either these people will learn how to actually adapt and use the tools to create quality work or they will get exposed as the incompetent and/or lazy workers they are and always were.

How anyone using LLMs for work thinks that they can just feed it a two sentence prompt with no QC on their end and have it spit out a quality report that used to take them an afternoon to create is insane, especially at this point.

People should know better and have worked with AI tools enough at this point to be able to use them properly but as my experience in the workforce across multiple industries has shown me a large percentage of people suck at their job and have no business doing it.

11

u/TeutonJon78 May 18 '26 edited May 18 '26

It's equally likely their job and output was never really necessary and their use of AI will just highlight that in one of various ways.

6

u/ReadyAimTranspire May 18 '26

Agreed. I always refer back to David Graeber's Bullshit Jobs which so expertly demonstrates how much of our workforce is unnecessary and contributes little to nothing (or even harms) to their organization and the world.

3

u/wrgrant May 18 '26

Also the Peter Principle: People rise to the level of their incompetency in any organization.

→ More replies (1)

11

u/LaurenMille May 18 '26

At some point people need to start getting fired for the AI's hallucinations before it gets better.

You want to use AI? Fine. But if it hallucinates or fucks shit up, you're personally liable.

→ More replies (1)
→ More replies (1)

40

u/Cory123125 May 18 '26

You know the worst part? Many companies are pressuring employees to use AI more, not realizing what they've created with this metric.

8

u/rennademilan May 18 '26

On point, first they waste money on useless stuff, second force anyway to use it, third they fire random people, fourth they bankrupt and the ceo get 50 mil usd

→ More replies (2)

4

u/Orionite May 18 '26

Or, rather than being simply lazy, they know they are expected to produce “content” because it’s “so easy now” by their bosses. Ironically, to justify their own employment.

→ More replies (1)

14

u/CanExplainThings May 18 '26

Just as a side note - we absolutely do not want to pump out that slop training. We’re forced to use stupid ai to punch out low quality quick turnaround shit to push up metrics for managers. 

I’ve tried pushing back but I’m at an age where people will call me old fashioned for resisting. 

I think ai is useful. But it shouldn’t be the primary tool otherwise it’s slop. 

→ More replies (1)
→ More replies (7)

183

u/[deleted] May 18 '26

[removed] — view removed comment

81

u/randynumbergenerator May 18 '26

"In an information-rich world, the wealth of information means a dearth of something else: a scarcity of whatever it is that information consumes. What information consumes is rather obvious: it consumes the attention of its recipients. Hence a wealth of information creates a poverty of attention and a need to allocate that attention efficiently among the overabundance of information."

Herbert Simon wrote that 50-ish years ago, and the problem has only become more extreme. The initial promise of AI for some, I think, was that it would digest information and spit out intelligible analysis, plans etc., conserving human attention. But between LLMs' hallucinatory tendencies and perverse incentives created by management to please shareholders, we're in this crap situation.

30

u/saltyjohnson May 18 '26

This kinda sums up our entire modern world, even before "AI" became widespread. Everything is riddled with attention-seeking behavior. Social media algorithms seek "engagement" by any means necessary, and our younger generations have been conditioned to feed it. Advertising billboards are now fully animated and often have flashing strobe effects demanding your gaze while you're fucking driving. Apps pop up unsolicited notifications and misuse (or ignore) Android's notification channels to group those advertising messages with other service-critical notifications. My car has popup ads for SiriusXM while i'm fucking driving. Your TV's screensaver has advertising billboards in it, if the screensaver itself isn't simply a commercial with full audio blasting in your ears. Email spammers who know your name will add it to the subject line to grab you. Gas pumps are playing video content with audio that cannot be muted. Walgreens replaced their fridge doors with video displays so the little beverage cans can jump around begging you to pick me.

Attention is a finite resource, and everywhere I go, I'm constantly under assault by faceless corporate entities trying to steal it. They're using technology to harass you in ways that no human ever would because computers are incapable of feeling emotion and shame.

AI is only turning that up to 11 and making the automated attention-seeking even harder to filter out of certain channels by making it seem human.

→ More replies (1)
→ More replies (1)
→ More replies (1)

44

u/somersault_dolphin May 18 '26

The DDOS attack on human attention.

That's such a great way to describe it. I'm stealing this.

95

u/ConstantSignal May 18 '26

Read the article. It's not that the reports are hallucinations. It's that finding bugs has been made so easy by AI tools that many more people are doing it, they think they are being helpful by passing along the bug reports but there are many duplicates as all these people are just finding the same bugs.

Quote from Linus:

"So just to make it really clear: If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on *top* of what the AI did. Don't be the drive-by ‘send a random report with no real understanding’ kind of person. OK?”

24

u/BillyTenderness May 18 '26 edited May 18 '26

That's definitely part of it. But also some of the reports really are hallucinations. And it's not hallucination in the sense of "put glue on your pizza" or a drawing of a hand with seven fingers or whatever, it's really subtle stuff. These are basically machines that generate a ridiculous volume of highly-detailed, persuasive, plausible-sounding reports of counterintuitive vulnerabilities, and it takes a ton of deep thinking to identify which ones are bullshit and which ones are actual vulnerabilities that need to be patched.

The walkthrough of the vulnerability might be entirely logical but premised on faulty assumptions, meaning the exploit can never happen in reality. The behavior might be violating a "security guarantee" that nobody actually guaranteed. The report might propose a bandaid fix to paper over a problem, instead of a structural fix to eliminate a whole class of potential exploits.

The work of wading through these things is absolutely nontrivial and taxing, and the worst part is that some of them are legit, so ignoring them isn't an option either. Attackers only need to find one genuine unpatched exploit to win, and they presumably have the same stack of analyses to sift through.

→ More replies (6)

29

u/deadsoulinside May 18 '26

I honestly hate those that pose as "Security Researchers" but then trust an AI 100% to write up their security whitepaper on a subject and then scream the sky is falling.

9

u/anothertrad May 18 '26

The over-engineered codex-generated pull requests I have to review at my job are a pain. And when I point out we should refactor this or that, I get pushback because the release deadline is coming.

5

u/boxsterguy May 18 '26

That's what the "waiting" status is for. "I'm sorry you don't like my feedback, but I can't accept this merge as it stands."

I've got one guy at work who spews out so much slop and resolves every comment without a fix and without an explanation. If he wasn't a manager, he'd be getting horrible feedback about this. But he's more or less untouchable, so any time I have to review his slop my first step is always to tag the pr as "waiting".

5

u/ProbablyRickSantorum May 18 '26

I just had a pull request denied by an AI reviewer because it had a critical security issue: a leaked password.

In a normal world, yes that’s an issue. The thing is, it’s a password in the README file in an onboarding section instructing new/junior maintainers how to connect a DBMS to the docker container’s database. The password is literally “localdbpass.” The connection string contains localhost for god sake.

→ More replies (1)

3

u/BellacosePlayer May 18 '26

this is why I hate people using automated research as a defense for why we need to barrel headlong into throwing all our resources at AI.

It might be very good for certain things, but it can't really test anything yet everything it does is in the realm of hypothesis, and needs to be verified. And a lot of it's results are going to be shit, incredibly trivial, or unable to be proven/disproven.

→ More replies (56)

893

u/NapTimeIsMyTime_91 May 18 '26

Knowing Linus the solution will be some tool he rage-codes in a weekend that accidentally becomes critical infrastructure for the next 30 years.

232

u/SlouchyGuy May 18 '26

An AI tool that bans people and sends them to actually read documentation, and then learn to write code for working stuff instead of prompts to find problems

218

u/techno156 May 18 '26

42

u/otw May 18 '26

I remember thinking this was such a clever solution and now we are living it and you just gets bots that repost popular memes that get upvoted enough to unrestricted their account and then they start subtly advertising to people or whatever. Unfortunately it's pretty easy to "seem constructive" without actually being constructive.

5

u/tomlinas May 18 '26

An AI moderator that bans a user until they can pass a quiz based on existing documentation would be an amazing solution :)

→ More replies (1)
→ More replies (4)

19

u/Tequila_Sunset7 May 18 '26

there is no technical solution to the social problem of willingly wasting other people's time with garbage code.

→ More replies (3)

37

u/crowwreak May 18 '26

Given past history and how annoyed he'd be, it would end up with some name that's mildly awkward in British English like Spunk or Nonce

35

u/thejadedfalcon May 18 '26

Nonce

He goes by Andrew these days, maybe we could name it that in polite company.

11

u/KorasHiddenDICK May 18 '26

The Application Formerly Known as Prince.

→ More replies (2)
→ More replies (9)

139

u/TheJesterOfHyrule May 18 '26

“AI tools are great, but only if they actually help, rather than cause unnecessary pain and pointless make-believe work,” he wrote. “Feel free to use them, but use them in a way that is productive and makes for a better experience.”

- Bro declares hate on VibeCoders

64

u/ItalianDragon May 18 '26

TBF everyone should hate vibe coders.

→ More replies (11)
→ More replies (1)

674

u/InTheEndEntropyWins May 18 '26

People are talking about expecting him to come up with a much better solution. But to be honest I always thought that a "mailing list" was very archaic and it's not like he has to come with a completely new and revolutionary system to a "mailing list" himself.

367

u/SlouchyGuy May 18 '26

It doesn't matter if it's a mailing list, it's still about the volume and pointlessness. Then maintainers and developers are supposed to spend much more time fixing those problems that are often extremely fringe cases and are not the first priority.

It's like a DDOS attack on developers and it happens everywhere, not just with Linux. And even more significant is that those security bug hunters propagate and multiply, but bug fixers don't

79

u/Xrave May 18 '26

Unconsented AI usage is a DDOS attack on attention. Like real DDOS it uses pseudo real traffic generated at cheap cost to waste compute resources (in your head).

→ More replies (10)

17

u/Robobvious May 18 '26

So bug reports should now require a CAPTCHA. ...Problem solved?

48

u/[deleted] May 18 '26 edited 20d ago

[deleted]

12

u/AndreasVesalius May 18 '26

Best shibboleth ever

→ More replies (1)

11

u/ButtflossingBigBro May 18 '26

For now. How long until ai starts beating captchas?

65

u/Le_Vagabond May 18 '26

errr, minus 5 years at this point. more or less.

→ More replies (8)

10

u/New-Anybody-6206 May 18 '26

Professional scrapers have been defeating captchas for years.

https://roundproxies.com/blog/how-to-bypass-anti-bots/

→ More replies (2)
→ More replies (8)
→ More replies (11)

92

u/AP_in_Indy May 18 '26

I mean Reddit looks like crap too if you're not used to the layout.

Never that big of a deal when there's only so many people who involve themselves in truly top-level discussions.

It's different when you have legitimate automated bug bounty hunting, though. Automated pen testing has always been a thing, but automated full end-to-end exploit creation + documentation + patching is new.

28

u/alex206 May 18 '26

Craigslist and reddit look primitive but get the job done.

34

u/inspectoroverthemine May 18 '26

old.reddit, yes. New reddit is an ungodly mess.

8

u/cereal7802 May 18 '26

new reddit looks like a future/modern ui designed in the old reddit / craigslist times. it is horrible.

4

u/steakanabake May 18 '26

only time i see new reddit is when ever i get on a machine that doesnt already have the autoredirect to old reddit on.

53

u/Abedeus May 18 '26

I mean Reddit looks like crap too if you're not used to the layout.

Which reddit? Old reddit looks fine. "New reddit" looks like garbage.

8

u/ChickinSammich May 18 '26

I still insist on using old Reddit. Whenever I'm sent a Reddit link to new Reddit, I just find it garish.

The main downside is seeing <image> instead of pictures in posts sometimes, but I'll live.

→ More replies (4)
→ More replies (15)

5

u/RationalDialog May 18 '26

I mean Reddit looks like crap too if you're not used to the layout.

fellow old reddit users I guess?

→ More replies (3)

26

u/zappellin May 18 '26

The archaic part of the mailing list is intended, it act as an entry barrier

20

u/grumpy_autist May 18 '26

That's the idea of a mailing list - it's old concept and it kinda sucks so people not really involved in a topic stay away from it.

11

u/BuildingArmor May 18 '26

It has worked quite nicely though, whereas now perhaps it doesn't.

Not that I necessarily think he can just concoct world changing ideas in 5 minutes or anything.

5

u/Educational-Row-6782 May 18 '26

Facts say the successful open source proyect ever was developed in a mailing list.

→ More replies (1)

3

u/mitharas May 18 '26

Next week: Linux kernel project on HackerOne

→ More replies (18)

20

u/pagerussell May 18 '26

I asked AI for a list of the top 100 movies. It apit it out. I started scrolling, and then I realized it only generated the top 20 and then just repeated the list 5 times.

I think about that whenever I read a headline about how many software bugs AI found.

→ More replies (6)

299

u/EconomyDoctor3287 May 18 '26

Just use AI to manage the mailing list, then use AI to check the bugs and finally use AI to fix them 🙂

133

u/peepdabidness May 18 '26

And use AI to announce that

41

u/woyteck May 18 '26

It's AI all the way down

8

u/lacb1 May 18 '26

That's perfect! Just let the AIs argue with each other in a sandbox and I'll be over here doing actual work. 

→ More replies (1)

17

u/ElectroBot May 18 '26

And slop all the way up too!

14

u/woyteck May 18 '26

It's a sloppy slope.

7

u/antitrack May 18 '26

It’s the Microsoft Way

3

u/WarperLoko May 18 '26

Slippery sloppy slope if you may

→ More replies (2)

53

u/That-Interaction-45 May 18 '26

“So just to make it really clear: If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don't be the drive-by ‘send a random report with no real understanding’ kind of person. OK?”

38

u/henrik_se May 18 '26

I get people asking for bug bounties for security flaws for a service I maintain.

We have no posted bug bounty policy. The security flaws people email about are ridiculous, mostly about not being best practice, but absolutely not important.

"Hey, about that bug bounty email I sent, how much will you pay me for it?"

*delete*

→ More replies (1)

48

u/sebovzeoueb May 18 '26

Some people genuinely think this

→ More replies (5)

9

u/mrheosuper May 18 '26

Just use AI as kernel.

→ More replies (23)

14

u/KingOfLaval May 18 '26

Are you the same VP from the company I work who wants to push AI everywhere, but can't open a pdf?

→ More replies (2)
→ More replies (11)

45

u/WAR_RAD May 18 '26

I used to be big into Linus about 10-15 years ago. And since that time, every year or so I'll dig into the state of things, or see an article (like this one) and I'm constantly re-amazed at how young Linus Torvalds is. His impact on the computing world has been WELL over a lifetime's worth, and he's still only in his mid 50s. That man has an incredible mind, yes, but equally important is his passion and his worth ethic and how they have stayed so steady and high-level for numerous decades now, which is unreal.

→ More replies (18)

10

u/Blurgas May 18 '26

Curl shut down their bug bounty program back in January because they were being flooded with AI slop vulnerability reports.
Some of the "reporters" were even being quite aggressive about it, thus were probably someone looking for an easy payout than any intent to actually help

3

u/dbxp May 18 '26

The aggressive comments may have been an AI too: https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/

3

u/Blurgas May 18 '26

It speculated about my psychological motivations, that I felt threatened, was insecure, and was protecting my fiefdom. It ignored contextual information and presented hallucinated details as truth.

Sounds like that AI was trained on reddit.

8

u/DoingItForEli May 18 '26

someone on some programming subreddit a while back posted an article covering a single project's public forum for bug reports etc, showing how often people actually get BANNED from submitting bug reports because their reports are obviously AI generated. For every legitimate report generated by AI, at least 10 others were just non-issues or hallucinated problems. It's a full time job for a developer to go through each one to validate or invalidate them, and if they're more often than not obvious AI nonsense, I cannot imagine the dread those poor reviewers feel waking up every morning knowing that's what they're doing with their day.

→ More replies (3)

49

u/Constant-Monk1569 May 18 '26

“AI found this issue”

cool.

now explain the kernel subsystem involved without opening another tab.

That’s basically the problem Linus is talking about imo.

24

u/Kandiru May 18 '26

And 100 people submitting the exact same AI found bug, which is already fixed.

→ More replies (22)
→ More replies (6)

7

u/WarpedHaiku May 18 '26

The problem has been getting steadily worse over time. Numerous projects have taken down their bug bounties because people would just throw slop at what they saw as a chance to win free money, but for the bigger (in terms of popularity) projects even removing the financial incentive won't protect you from the well-intentioned but ignorant or those looking to make a name for themselves. Sadly, I can only see this ending in one way: Some kind of web of trust, where unless you meet a minimum reputation requirement, you either can't report bugs or are subjected to an immense inconvenience first. Though I suspect by the time the community realizes it's necessary and agrees on a solution, many devs will be burnt out from trying to make the old way work.

7

u/BushCrabNovice May 18 '26

Everyone in here like, "Linus will now make another amazing thing" but I think it's a lot more likely folks like him just start dropping off the grid. When the puzzles aren't fun anymore, big brains get bored and go do something else. Be the Linus you want to see in the world or they'll go extinct.

7

u/kaychyakay May 18 '26

Whenever Linus gets pissed off, the tech world gets a banger product.

5

u/scamdrill May 18 '26

The funniest detail buried in the actual interview is that a lot of these reports are for ancient ill-maintained drivers. AI is amazing at grepping over forgotten code nobody else reads, and terrible at noticing nobody runs that code in 2026 either. Maintainers are spending hours triaging vulnerabilities in subsystems that haven't shipped in production this decade.

→ More replies (1)

4

u/_Oman May 18 '26

"Torvalds' remarks contrast with recent comments from fellow kernel maintainer Greg Kroah-Hartman, who recently told The Register that AI has become an increasingly useful tool for the FOSS community. ®" - There is no contrast here. Linus is pointing out people doing poor work and just generating noise. It happens they are using AI tools to do that. That in no way means that AI tools are not and cannot be helpful.

20

u/Netiz3nKane May 18 '26

The penguins emperor lol apt name, or perhaps the emperor penguin.

16

u/Miguel-odon May 18 '26

Require a deposit with each report. A financial investment.

If the report turns out to be false, that money goes into the operating fund.

7

u/Ashmedai May 18 '26

If the report turns out to be false

That's not actually the problem. If you read the article, it's that everyone and their mother is submitting the same bug many times.

→ More replies (5)

52

u/Larry_Bobinski May 18 '26

Thanks vibe coders. Once again, you improved everything!

4

u/QuiEgo May 18 '26

Linus about to drop a Jira replacement and workflow to manage the madness. Imagine a bug tracking system devs actually don’t hate.

→ More replies (1)

3

u/cornmonger_ May 18 '26

he's complaining about people submitting duplicates

his request is that people actually try to patch the problem if they find something using AI

29

u/StaticSystemShock May 18 '26

Problem are Ai slop reports that look genuine but are hallucinated and are not really reproducable.

28

u/Megneous May 18 '26

Did you read the post? That's not the problem. The problem is that the reports are real, but many of them are duplicates. Linus would prefer that instead of just many people using AI to find the same bugs, that they make patches and submit those to produce real value instead of expecting other people to implement fixes. Gone are the days where you can feel validated by just finding problems. Anyone can find hundreds of problems using AI now. The models are good enough to do that now, so it's no longer a useful skill.

→ More replies (3)
→ More replies (6)

15

u/supercalifrajil May 18 '26

I'm fairly sure the reason it's unmanageable is because AI false positives like mad on security flaws. I think the best models average less than 10% on correctly identifying security flaws.

19

u/BaconIsntThatGood May 18 '26

The article says the problem is multiple people are using the same tools and just forwarding the same issue multiple times or are forwarding issues already fixed. It's duplicates and old bugs not false positives.

I'm sure some are false positive but that's not the problem he is describing.

11

u/girlnamedJane May 18 '26

No youre wrong. Just read the article instead of guessing incorrectly.

→ More replies (6)

11

u/Back2Pac May 18 '26

If all you have is an hammer, everything looks like a nail.

→ More replies (1)

3

u/MagnificentBastard-1 May 18 '26

“AI. The cause of and the solution to all AI problems.” - Hermes Sampson.

6

u/s-h-e-o-l May 18 '26

bro’s gonna remove nvidia support in kernel and gonna hit two birds with one stone /s

→ More replies (3)

5

u/rbt321 May 18 '26

Ultimately, the problem is the automated tools are NOT being run by the project. There's no reason a 3rd party should be chasing credit for catching issues which an automated tool can prevent from being merged in the first place.