pull down to refresh

416 sats \ 2 replies \ @optimism 29 Aug \ on: Is AI breaking the old rules of responsible disclosure? AI bitcoin lightning
Is AI breaking the old rules of responsible disclosure?

Yes.

This is the current policy for the Linux kernel (which has been adapted to an AI reality):

Once a robust fix has been developed, the release process starts. Fixes for publicly known bugs are released immediately.

Note that what kernel-security perceives as a "publicly known" bug includes those found with LLMs:

Do not send it to a public list at this stage, unless you have good reasons to consider the issue as being public or trivial to discover (e.g. result of a widely available automated vulnerability scanning tool that can be repeated by anyone, or use of AI-based tools).

So, for this case with CLN, kernel would have just published the source and y'all better pay attention.

Although our preference is to release fixes for publicly undisclosed bugs as soon as they become available, this may be postponed at the request of the reporter or an affected party for up to 7 calendar days from the start of the release process, with an exceptional extension to 14 calendar days if it is agreed that the criticality of the bug requires more time. The only valid reason for deferring the publication of a fix is to accommodate the logistics of QA and large scale rollouts which require release coordination.

And they'd do the same if it wasn't some LLM-discovered bug unless you beg for it.

write
compose
125 sats \ 1 reply \ @39963a0737 OP 29 Aug freebie

Yeah, fair point. I think I was giving AI a bit too much credit for changing the rules here.
The Linux kernel example makes that pretty clear — the basic problem was already there.
What AI probably changes is the speed. If patch diffing and digging through the affected code can be automated more and more, that window between releasing the fix and people actually upgrading gets uncomfortable pretty fast.
So maybe it's less "AI is changing responsible disclosure" and more "AI is making the old rules matter a lot more."
Thanks for the Linux reference btw, I'm going to dig into that.

reply
84 sats \ 0 replies \ @optimism 30 Aug

There's been a lot of chatter on the mailing lists about it. Kernel-security was among the first of the sec teams to say: yo we're now not just getting some dupes, but we're getting dupes all the time, for almost half the bugs (dupe here is you're working on a bug and someone else reports it to you again, and again, and again.)

So they tuned it a bit and wrote some nice "if you use AI tools please don't be a dick, here's instructions" guidelines. I do like that they keep at least the door open to some options to embargo - as much as I've personally hated needing them - because you cannot statically dictate them away. But overall, I see it moving to less embargo, more user responsibility. If something is broken and you don't update, that's on you, not on the devs.

Though QA timing post-fix is still a hurdle. Right now I have a half finished review sitting in my review repo and I've already found so much shit that I'm really out of energy to finish it. But not finishing it also means I don't update, because I hate updating blind. So yeah... AI changed a lot, but the impact on the consumer side is harder than most realize.

Embargo messes with me, no embargo, at this current rate... also.

reply