If your Open Source project sees a steep increase in number of high quality security reports (mostly done with AI) right now (#curl, Linux kernel, glibc confirmed) please tell me the name of this project.

(I'd like to make a little list for my coming talk on this.)

@bagder

Just so I understand this correctly...
We don't want machine generated vulerability reports...

...so we can leave our #foss projects vulnerable to hackers who are not constrained by ideology in their sploits using #Ai ?

Yeah, that tracks with the current majority of #infosec "professionals" letting the Rome burn while they roast the marshmallows, feeling super pure and superior.

@n_dimension @bagder The projects typically want security/bug reports, not computer generated words that *look* like security/bug reports.

Same reason you don’t want parrot operating your air traffic control tower radio. Do you want an air traffic controller or a parrot that sounds like an air traffic controller? Do you trust the parrot to safely direct planes according to aviation regulations?

@ClickyMcTicker @bagder

Even a broken clock is right twice day.

Lucky then the project maintainers don't have to be bothered by minutea of securing their projects with automation...

...because #blackhats certainty don't have the same reservations.

#Ai is a new attack surface and acting irrational and emotional towards it is incomprehensible

#infosec

@n_dimension @ClickyMcTicker @bagder a broken clock is not “right”, because its value as a timepiece is nonexistent, because there is no way of telling *when* it is right.

@RoganDawes @ClickyMcTicker @bagder

Time flows independent of the perception of the observer, therefore the timepiece is correct twice as time in the 24 period is linear and constant.

@n_dimension @ClickyMcTicker I’d argue that a clock that cannot be relied upon to provide a reasonably accurate time 99% of the time (modulo replacing a battery or similar) is useless 100% of the time.

@RoganDawes @ClickyMcTicker

Huh, what do you know, it is 99.8%