daniel:// stenberg://The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a ... plain security report tsunami. Less slop but lots of reports. Many of them really good.
I'm spending hours per day on this now. It's intense.
Dirk Hohndel@bagder
At least it's spending time on stuff that's somewhat worth while?
But still, it's a DDOS on maintainers
At least it's spending time on stuff that's somewhat worth while?
But still, it's a DDOS on maintainers
@dirkhh it's actually really hard to complain when the reports are good, but yeah we're still humans who need to deal with all this
Petr Menšík 
Gregory P. Smith (he/him) 
🚲🦝 
@pemensik @bagder @dirkhh I have proposed fixes on some security reports to projects. One reason I'm leery of always doing so all the time is that a well written report can just as easily be fed by the receiver into their Claude to do the same work - but they'll have far more project context to guide it towards an acceptable result.
Remeber that for security reports, even before 2026, those are often filed against projects that reporters aren't already intimate with. We don't want to discourage reports of issues just because they don't include a fix.
At the same time, it is *always* fair for security report receivers to ask the reporter if they are able to write or generate any.
Remeber that for security reports, even before 2026, those are often filed against projects that reporters aren't already intimate with. We don't want to discourage reports of issues just because they don't include a fix.
At the same time, it is *always* fair for security report receivers to ask the reporter if they are able to write or generate any.
@gpshead @bagder @dirkhh I disagree. First thing is you expect every upstream is paying for Claude access and is proficient with it or similar thing. That is not necessary true. Your report causes human work on it. If you can minimize their work on your report and have resources for it, proposal with fix included should be automatic. If that is not accepted, okay only few watts wasted.