Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux security mailing list 'almost unmanageable'

theregister.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Linux security mailing list 'almost unmanageable'

#81

Post by pavon »

NoSalt wrote: post #33

So ... who, exactly, is AI supposed to be "helping"???

The bug reports are helpful! Many Linux developers including Linus, Greg Kroah-Hartman, Andrew Morton, Chris Mason, and Willy Tarreau have all commented positively on all the legitimate problems that are being found with LLM. Here is just one example article[1].

This is just a workflow issue. In the past it was very rare for multiple people to find and report a security vulnerability at once, so it made sense to keep the discussion private until they were ready to release a fix. With AI that is happening all the time, so it makes more sense for the discussion to be in public to avoid duplication. So they changed the policy accordingly. That is it.

[1]https://lwn.net/Articles/1066581/

Re: Linux security mailing list 'almost unmanageable'

#82

Post by jmalicki »

mort96 wrote: post #74
jmalicki wrote: post #37

Earlier quoted context omitted.

Does a 26MB message actually cause noticeable strain on the server much beyond loading the page? I would think serving a contiguous 26MB chunk would be relatively similar to say 20 normal sized messages.

Way off. I went to an arbitrary message on lore.kernel.org. Firefox's network inspector says 7.37kB was transferred, including stylesheets. 26MB is roughly 3500x 7.37kB.

Data transferred is not what generates load. sendfile() is about the lowest-overhead thing a web server does.

Re: Linux security mailing list 'almost unmanageable'

#83

Post by devsda »

sillysaurusx wrote: post #48
probably_wrong wrote: post #14

Earlier quoted context omitted.

I'd warn HN users not to click on that link simply because it will load a 26Mb message that will likely cause quite a strain on kernel.org's servers if everyone here does it.

I was curious how much of an impact HN could have. Napkin math: HN gets 24M views a day. Assume those views are evenly distributed across the front page (they aren’t), and that’s about 1M views for each front page post, assuming each user clicks on one post. By the rule of 10s (also not exact), there are 10x less views on comment threads. So assume around 100k views on a comment thread as a theoretical average. If ev…

Don't forget scrapers. Scrapers can be biased towards top posts and comments.

Re: Linux security mailing list 'almost unmanageable'

#84

Post by toast0 »

trelbutate wrote: post #34

Will never understand why some people prefer mailing lists to do development, it always feels like the most convoluted way to hold a discussion, especially if there are multiple topics at the same time. It probably doesn't really change that much in this scenario but with a forum or any other topics-based platform you can at least just close and ignore these things without it affecting everyone else.

Usenet is probably better, but to a rough approximation, nobody has access to a usenet feed anymore.

Mailing lists allow people to use threads if they want (assuming nobody thrashes the threads headers by using terrible email software from Microsoft/Google), and also allows people to read from the firehose if the want. And there's plenty of threaded web views of mailing lists available for lurkers.

Re: Linux security mailing list 'almost unmanageable'

#85

Post by wang_li »

kirtivr wrote: post #53

I'd really like maintainers to get their hands dirty with AI agents as well to help speed up the reviews. Over the last year there have been way too many stories and Twitter posts like these. Yes, maintainers are overloaded, but that's only because we haven't yet built the tools to support them. Other than such statements, I would, as a builder like to hear the sorts of tools and requirements maintainers are looking…

The world doesn't need to support the projects and research areas that interest you. How about we do something better: No one is allowed to say or write anything about AI or AI generated slop until AI is 100% perfect and produces zero errors and does everything with perfect efficiency.

AI trash like this is like showing up to a baseball game with a pitching machine and demanding that they let you join in and be the pitcher using your machine. Just because your slop cannon is fun and exciting to you doesn't make anyone else obligated to join your club just because you fired your slop on them.

Re: Linux security mailing list 'almost unmanageable'

#86

Post by throwaway85825 »

quuxplusone wrote: post #30
throwaway85825 wrote: post #12

Earlier quoted context omitted.

If the LLM hallucinates bugs what makes you think any classification won't be hallucinated?

The issue highlighted in Linus's message isn't that the LLM is hallucinating fake bugs; it's that 100 people running the same LLM on the same codebase find the same real bug 100 times, and if they all send it to the private security mailing list, it's (1) unmanageably high volume and (2) stupid security theater [because by definition any bad actor with the same LLM would find that bug — it's effectively public at tha…

You don't need an LLM to deduplicate bugs, just categorize by files affected. The real security problem is LLMs have a ~499/500 false positive rate and the new 'security research' post this slop and DDoS the mailing list.

Re: Linux security mailing list 'almost unmanageable'

#87

Post by nolist_policy »

SoKamil wrote: post #49
PurpleRamen wrote: post #39

Earlier quoted context omitted.

A good mailclient allows a skilled user a much more efficient communication than most forums. > It probably doesn't really change that much in this scenario but with a forum or any other topics-based platform you can at least just close and ignore these things without it affecting everyone else. True, external moderation is a benefit of centralized platforms, but a mailclient allows personalized moderation, which all…

Is there a demo of such communication on YouTube, or at least some article with screenshots?

http://www.kroah.com/log/blog/2019/08/14/patch-workflow-with...

Re: Linux security mailing list 'almost unmanageable'

#88

Post by Sebguer »

st_goliath wrote: post #8

Here's the actual mailing list post: https://lore.kernel.org/lkml/CAHk-=wi+JvcuKF2NaD_rGiYrwkR6rx... Actual context: Linux 7.1-rc4 release, Linus remarked on a specific documentation change. The Register somehow turned this into an "article" that says a lot less with roughly the same number of words, and provides "context" by linking to a number of unrelated articles.

The Register has always been a... weird 'news' source, but they've gotten significantly worse over the last year or two.

Re: Linux security mailing list 'almost unmanageable'

#89

Post by rsync »

trelbutate wrote: post #34

Will never understand why some people prefer mailing lists to do development, it always feels like the most convoluted way to hold a discussion, especially if there are multiple topics at the same time. It probably doesn't really change that much in this scenario but with a forum or any other topics-based platform you can at least just close and ignore these things without it affecting everyone else.

"Will never understand why some people prefer mailing lists to do development ..."

The people who have this preference are processing the mailing lists with a highly specialized mailtool, not a web browser.

If you have only ever accessed email with a web browser it is not surprising that you find the mailing list format weird.

Re: Linux security mailing list 'almost unmanageable'

#90

Post by skydhash »

trelbutate wrote: post #34

Will never understand why some people prefer mailing lists to do development, it always feels like the most convoluted way to hold a discussion, especially if there are multiple topics at the same time. It probably doesn't really change that much in this scenario but with a forum or any other topics-based platform you can at least just close and ignore these things without it affecting everyone else.

It’s an open format and with basic tools, you can create a very good pipeline to consume the information. There’s no ceiling on the convenience and automation. Gmail and other webmail client are not a representation of good email workflow.
Post reply on HN