Linux security mailing list 'almost unmanageable' • Hacker News Board

Re: Linux security mailing list 'almost unmanageable'

#21

Post by cduzz » Mon, May 18, 2026, 1:55 PM UTC

flumes_whims_ wrote: post #16

cduzz wrote: post #6

Earlier quoted context omitted.

If the AI is awesome at identifying security bugs in the linux kernel, it likely can also identify if the thing it's found is similar to something that is already found in the security mailing list? Or, put another way -- what flags the duplicate? The filer or the system? If my cheese factory is measured by the volume of cheese instead of the quality, I'll churn out the cheese even if it's sloppy duplicated cheese. A…

> “AI detected bugs are pretty much by definition not secret, and treating them on some private list is a waste of time for everybody involved – and only makes that duplication worse because the reporters can't even see each other's reports.”

Ah; so it _is_ a tool problem. It is _also_ a moderation problem.

One could ban orgs that flood the zone with AI generated trash, but is there some potential middle ground where there are sets of filters to identify duplicated bugs, and possibly just internally dump "AI spam" to a lower queue?

This seems like the sort of problem I'd addressed in the 90s with killfiles and spamassassin. In other words, can't the ingestion just go through some filters to shield the humans at the end of the pipe?

Re: Linux security mailing list 'almost unmanageable'

#22

Post by newswasboring » Mon, May 18, 2026, 2:01 PM UTC

> Torvalds' remarks contrast with recent comments from fellow kernel maintainer Greg Kroah-Hartman, who recently told The Register that AI has become an increasingly useful tool for the FOSS community

Thats kinda a misrepresentation. They are talking about two different things. Linus is trying to point out incorrect use of a tool while GKH is praising a correct use. This sentence felt weird at the end of the article, kind like rage bait. And I took it :P.

Re: Linux security mailing list 'almost unmanageable'

#23

Post by orthoxerox » Mon, May 18, 2026, 2:01 PM UTC

Sweepi wrote: post #2

"Torvalds' remarks contrast with recent comments from fellow kernel maintainer Greg Kroah-Hartman, who recently told The Register that AI has become an increasingly useful tool for the FOSS community." Does it? Both points can be true at the same time.

AI can amplify your intelligence just as easily as it can amplify your stupidity. All while telling you how smart and brilliant you are.

Re: Linux security mailing list 'almost unmanageable'

#24

Post by fiedzia » Mon, May 18, 2026, 2:03 PM UTC

cduzz wrote: post #6

stabbles wrote: post #5

Isn't it mostly the medium that's problematic? With an issue tracker it's easier to close as duplicate

If the AI is awesome at identifying security bugs in the linux kernel, it likely can also identify if the thing it's found is similar to something that is already found in the security mailing list? Or, put another way -- what flags the duplicate? The filer or the system? If my cheese factory is measured by the volume of cheese instead of the quality, I'll churn out the cheese even if it's sloppy duplicated cheese. A…

> it likely can also identify if the thing it's found is similar to something that is already found in the security mailing list?

It can not because this mailing list is not public.

Re: Linux security mailing list 'almost unmanageable'

#25

Post by OuterVale » Mon, May 18, 2026, 2:03 PM UTC

leonidasrup wrote: post #18

probably_wrong wrote: post #14

Earlier quoted context omitted.

I'd warn HN users not to click on that link simply because it will load a 26Mb message that will likely cause quite a strain on kernel.org's servers if everyone here does it.

https://web.archive.org/web/20260518134447/https://lore.kern...

I don't think needlessly straining the Internet Archive's servers is any better.

Re: Linux security mailing list 'almost unmanageable'

#26

Post by dgellow » Mon, May 18, 2026, 2:06 PM UTC

stabbles wrote: post #5

Isn't it mostly the medium that's problematic? With an issue tracker it's easier to close as duplicate

You still spend time identifying duplicates and doing triage. That can be very significant for a project like Linux.

Interestingly enough doing that type of triage is something LLMs are actually great at

Re: Linux security mailing list 'almost unmanageable'

#27

Post by j16sdiz » Mon, May 18, 2026, 2:07 PM UTC

Sweepi wrote: post #2

"Torvalds' remarks contrast with recent comments from fellow kernel maintainer Greg Kroah-Hartman, who recently told The Register that AI has become an increasingly useful tool for the FOSS community." Does it? Both points can be true at the same time.

Torvalds didn't say AI isn't useful. He is saying everybody use AI to file same duplicate bug report causing extra churn.

Re: Linux security mailing list 'almost unmanageable'

#28

Post by grosswait » Mon, May 18, 2026, 2:08 PM UTC

leonidasrup wrote: post #18

probably_wrong wrote: post #14

Earlier quoted context omitted.

I'd warn HN users not to click on that link simply because it will load a 26Mb message that will likely cause quite a strain on kernel.org's servers if everyone here does it.

https://web.archive.org/web/20260518134447/https://lore.kern...

Will clicking on this link download a 26MB message putting extra load on archive.org's servers?

Re: Linux security mailing list 'almost unmanageable'

#29

Post by throawayonthe » Mon, May 18, 2026, 2:09 PM UTC

st_goliath wrote: post #8

Here's the actual mailing list post: https://lore.kernel.org/lkml/CAHk-=wi+JvcuKF2NaD_rGiYrwkR6rx... Actual context: Linux 7.1-rc4 release, Linus remarked on a specific documentation change. The Register somehow turned this into an "article" that says a lot less with roughly the same number of words, and provides "context" by linking to a number of unrelated articles.

here is what seems to be the relevant documentation: https://docs.kernel.org/process/security-bugs.html

see "If you resorted to AI assistance to identify a bug, you must treat it as public." and https://docs.kernel.org/process/security-bugs.html#responsib...

Re: Linux security mailing list 'almost unmanageable'

#30

Post by quuxplusone » Mon, May 18, 2026, 2:12 PM UTC

throwaway85825 wrote: post #12

smallerfish wrote: post #11

Earlier quoted context omitted.

So make it a closed issue tracker with a public email gateway. Get Anthropic to donate LLM time to classify and combine incoming reports.

If the LLM hallucinates bugs what makes you think any classification won't be hallucinated?

The issue highlighted in Linus's message isn't that the LLM is hallucinating fake bugs; it's that 100 people running the same LLM on the same codebase find the same real bug 100 times, and if they all send it to the private security mailing list, it's (1) unmanageably high volume and (2) stupid security theater [because by definition any bad actor with the same LLM would find that bug — it's effectively public at that point].