[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <f296de5a-8c89-4678-ac2a-02b07dfd89e6@catalyst.net.nz>
Date: Thu, 21 May 2026 15:13:40 +1200
From: Douglas Bagnall <douglas.bagnall@...alyst.net.nz>
To: oss-security@...ts.openwall.com, Clemens Lang <cllang@...hat.com>
Subject: Re: Coordinated Disclosure in the LLM Age
On 30/04/2026 06:52, Clemens Lang wrote:
>> In other words, LLM-discovered vulnerabilities should be considered already publicly known.
>
> As a further data point backing up this theory: We’re seeing duplicate reports of the same issue found by multiple independent groups that use LLMs, within the embargo period.
In Samba we see maybe a third of valid security bugs being reported more
than once. So far I think the invalid ones are all invalid in their own
ways.
There is a counter-argument in favour of coordinated fixes, if not
disclosure, in that LLMs make it easier to create an exploit from a
patch or announcement. This means simultaneous patching is more
important, to the extent we worry about opportunistic low-skill attacks.
Perhaps much depends on deployment. There are engineers here whose
full-time job seems to be planning openstack upgrades, yet their
workstations will update curl or evince without interaction. It might
not be that all these projects should have the same security process.
Samba is continuing to muddle along more or less as before, though with
an eye to streamlining things.
Douglas
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
