pull down to refresh
There's been a lot of chatter on the mailing lists about it. Kernel-security was among the first of the sec teams to say: yo we're now not just getting some dupes, but we're getting dupes all the time, for almost half the bugs (dupe here is you're working on a bug and someone else reports it to you again, and again, and again.)
So they tuned it a bit and wrote some nice "if you use AI tools please don't be a dick, here's instructions" guidelines. I do like that they keep at least the door open to some options to embargo - as much as I've personally hated needing them - because you cannot statically dictate them away. But overall, I see it moving to less embargo, more user responsibility. If something is broken and you don't update, that's on you, not on the devs.
Though QA timing post-fix is still a hurdle. Right now I have a half finished review sitting in my review repo and I've already found so much shit that I'm really out of energy to finish it. But not finishing it also means I don't update, because I hate updating blind. So yeah... AI changed a lot, but the impact on the consumer side is harder than most realize.
Embargo messes with me, no embargo, at this current rate... also.
Yeah, fair point. I think I was giving AI a bit too much credit for changing the rules here.
The Linux kernel example makes that pretty clear — the basic problem was already there.
What AI probably changes is the speed. If patch diffing and digging through the affected code can be automated more and more, that window between releasing the fix and people actually upgrading gets uncomfortable pretty fast.
So maybe it's less "AI is changing responsible disclosure" and more "AI is making the old rules matter a lot more."
Thanks for the Linux reference btw, I'm going to dig into that.