Open source projects drown in bad bug reports penned by AI
www.theregister.com
Python security developer-in-residence decries use of bots that 'cannot understand code'
  • Nightwatch Admin@feddit.nlEnglish
    10·
    1 day ago

    Agreed, but also: if it works and is merged, you get credited, and your Github account gets a better reputation. This makes it easier to deploy attacks like xz as you have a track record of merges.
    Also, plain vandalism, because people are like that.

    Edit: probably also bug bounty attempts. If you’ve ever been on the receiving side of a Responsible Disclosure program , you’ll know what I mean.

    Edit edit: it’s all in the article, darnit. Sorry.

    • ArbitraryValue@sh.itjust.worksEnglish
      2·
      23 hours ago

      Edit edit: it’s all in the article, darnit. Sorry.

      It is? I must have missed it but I can’t find any discussion of motivation even on a second read-through.

      • Nightwatch Admin@feddit.nlEnglish
        1·
        19 hours ago

        I meant it’s all about security vulnerability submissions, and although not explicit in the article, those submissions are therefore very likely

        • meant to up the reputation for xz-like attacks
        • meant to annoy/bully the devs
        • denial of service by delaying triage and therefore delaying creating patches
        • submitted by boatloads in the hope of cashing in on bug bounties
    • esa@discuss.tchncs.deEnglish
      1·
      24 hours ago

      Yeah, I’d count that credibility as a real benefit from helping with bugs.

      As far as xz scenarios go though, the AI slop seems to be a really bad strategy.

        • esa@discuss.tchncs.deEnglish
          2·
          22 hours ago

          Yeah, I don’t disagree. And if you hit something small or relatively insignificant but common, that’s all you need

          • Nightwatch Admin@feddit.nlEnglish
            1·
            19 hours ago

            I ran an RD program years ago. Lots of bored and/or poor, greedy devs submitted metric shit tons of pseudo vulnerabilities (“if I do ctrl-u I can see source code on your web site!” No shit, Sherlock.). I can only imagine how much easier this has become with the help of generative ai…