[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <atTshVdmdK81NjVb@netmeister.org>
Date: Sun, 18 Oct 2026 11:57:57 -0400
From: Jan Schaumann <jschauma@...meister.org>
To: oss-security@...ts.openwall.com
Cc: Solar Designer <solar@...nwall.com>, shvedov@....com,
"David A. Wheeler" <dwheeler@...eeler.com>
Subject: Re: Proposal: Add separate
oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Martin Steigerwald <martin@...htvoll.de> wrote:
> I'd expect a wave of AI reports, but once they are fixed, these will not
> be reported again. Then maybe after using even better models and agents
> there might be another wave of more difficult to find issues that are
> reported. But then these are fixed as well.
>
> I would expect that a peak may be reached where AI only finds issues
> rarely anymore.
This sounds akin to proposing that, effectively, there
will be (almost) no more security vulnerabilities in
our software.
I don't see that happening.
The imbalance between the cost of identifying and
reporting issues versus analyzing and fixing them as
well as the cost of software development and
maintenance (both monetary as well as in terms of
infrastructure, support, and human time and brain
cells) in Open Source projects will, I expect, prevent
this utopic vision from coming true.
-Jan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
