[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <dc97be31-0762-4a91-a1ad-6795abaab8a9@foolishgames.com>
Date: Wed, 29 Apr 2026 00:29:35 -0400
From: Lucas Holt <luke@...lishgames.com>
To: oss-security@...ts.openwall.com
Subject: Re: Coordinated Disclosure in the LLM Age
While I see the temptation and the logic up to a point, dropping a 0-day
on a small project is not helping anyone. It *could* be discovered by a
LLM by another person, but that doesn't mean they are actually looking.
Large, popular projects are more likely to get widely scanned. Smaller
projects may not. I wouldn't expect 90 days but a few would be nice.
If someone is reporting to me that there is a vulnerability in a piece
of software, even if I use AI to fix it, I'm still going to need time to
test it before doing a release. The release process takes a few hours
for me. Then the test and patch time.
Pretend for a moment that you maintain a small project as a hobby. You
have a day job. Suddenly, a CVE is dropped on your lap mid day. You
didn't make anyone safer doing that. It's not like I'm going to get it
patched during work hours. Not everyone is Red Hat or Apple.
This happened recently to the rsync project. It could have waited a few
days to go public.
At a minimum, if you're going to go public, use your AI to include a
possible patch too. Don't just drop work on a random person because you
got to find it first. That's not cool.
--
Lucas Holt
Luke@...lishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
