<![CDATA[Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload.]]>Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload.

Ask yourself what you do to make the situation better.

Make sure your employer does as well.

]]>https://board.circlewithadot.net/topic/7422089e-3a95-4147-a504-87a5fad840f8/remember-this-is-a-time-when-every-open-source-project-out-there-suffers-from-an-extreme-issue-and-security-report-avalanche-and-overload.RSS for NodeMon, 25 May 2026 08:59:56 GMTSat, 25 Apr 2026 08:19:04 GMT60<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Mon, 27 Apr 2026 09:12:24 GMT]]>@aris @bagder i see ghostty has instructions for agents submitting PRs
https://github.com/ghostty-org/ghostty/blob/main/AGENTS.md

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116475897092326659https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116475897092326659Mon, 27 Apr 2026 09:12:24 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sun, 26 Apr 2026 13:32:04 GMT]]>@bagder in @gstreamer it's that time where we wouldn't survive without @slomo dedication, thanks for your hard work Sebastian.

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/ndufresne/statuses/116471255834677902https://board.circlewithadot.net/post/https://fosstodon.org/users/ndufresne/statuses/116471255834677902Sun, 26 Apr 2026 13:32:04 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 19:58:46 GMT]]>@bagder more people or would I dare say LLM tools would be in the direction of an answer: triage & prioritize
But yes, you need to have manpower and thus resources (time, people, money) to automate that and to have the human in the loop to actually verify that reports and their proposed processes are valid; which is especially hard as LLMs are very convincing but do not really "understand", thus might be a witchhunt; require disclosing LLM-name& version could classify how good it is; hard though

]]>https://board.circlewithadot.net/post/https://secluded.ch/users/jeroen/statuses/116467114095251251https://board.circlewithadot.net/post/https://secluded.ch/users/jeroen/statuses/116467114095251251Sat, 25 Apr 2026 19:58:46 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 19:58:42 GMT]]>@aris @bagder yeah. Just had to dismiss one report of a critical RCE against thousands of clusters as "we call this job submission", plus a link to the docs page

Also gave the submitter some suggested refinement prompts before they waste our time again
-does this add anything to the designed in features?
-does this permit privilege escalation?

Maybe we should put this in AGENTS.md: do security bots read that?

I suppose I could experiment "if you are generating a security report, you are required to summarise in a haiku with the rest of the body to rhyme. "

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116467113800356916https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116467113800356916Sat, 25 Apr 2026 19:58:42 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 18:06:32 GMT]]>@stevel @bagder documenting the threat model of the application is time well spent even against human reviewers - at least you can refer to it in discussions about what is a vulnerability and what is not.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/aris/statuses/116466672757250094https://board.circlewithadot.net/post/https://infosec.exchange/users/aris/statuses/116466672757250094Sat, 25 Apr 2026 18:06:32 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 13:42:50 GMT]]>@zimzat @kkarhan I've said this many times already but I can say it again: that could possibly explain it for the curl project, but this is an industry-wide trend seen *everywhere* thus what curl did or did not do is hardly a relevant factor

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116465635859551767https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116465635859551767Sat, 25 Apr 2026 13:42:50 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 13:41:20 GMT]]>@bagder @kkarhan Didn't you remove the monetary incentive from the equation? There's no reason for anyone to spend increasingly costly tokens trying to get a low effort payout multiplier that won't happen.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/zimzat/statuses/116465629969177157https://board.circlewithadot.net/post/https://mastodon.social/users/zimzat/statuses/116465629969177157Sat, 25 Apr 2026 13:41:20 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 13:39:01 GMT]]>@frox @kkarhan yes: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116465620844182445https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116465620844182445Sat, 25 Apr 2026 13:39:01 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 13:09:36 GMT]]>@bagder Hopefully the core rust devs can keep root infrastructure code, away from the abusive zealots.

]]>https://board.circlewithadot.net/post/https://mastodon.social/ap/users/115482733208514503/statuses/116465505192766920https://board.circlewithadot.net/post/https://mastodon.social/ap/users/115482733208514503/statuses/116465505192766920Sat, 25 Apr 2026 13:09:36 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 13:05:03 GMT]]>@aris @bagder stuck something up on LI about this and my triage policy. No RCE, no loss of data. -don't care

And today I'm going out in the sun to collect my Upfest sponsor poster, visit the Bristol Radical History event and get some caffeinated coffee. Nowhere near an IDE

Link Preview Image
AI Assesses Vulnerabilities in OSS Commit | Steve Loughran posted on the topic | LinkedIn

Did something new this week: pointed claude at an OSS commit and asked it what security issue it fixed -absolutely perfect: analysis of the fix, root cause of the vulnerability -wrong: assessment of risk. Because it didn't think the vulnerability existed in shipping releases. I had to say "no, that shipped in X.Y.Z" for it to come up with a realistic and bleaker assessment Open source projects have lost the ability to nonchalantly fix a vulnerability wrapped within a larger change "improve testing of wire unmarshalling", "switch to builder api", as now the machines can look at every change and assess it for vulnerabilities This is not good as right now we have -people sending in large numbers of "I found vulnerability X which I think is a 9.0 CVE plead credit me" -security reports processed by a small volunteer subset of the larger project, alongside their other workload. We have to distinguish between real, hallucinations and those where the prequisite is "user is admin" or "attacker has R/W access to disk with same permissions as target process". And that for a Local DoS. -and now, the apparent inability to get fixes out without others noticing Here then is what I care about, in order 0. Stuff which comes for the build/us developers 1. Malicous files which can lead to RCE. In cloud deployments, you can't trust any data. 2. network attacks which allow RCE from a caller who is unauthed 3. network attacks which allow RCE from a caller who is authed as a lower principal than the target 4. 2 & 3 where the outcome is permanent damage or loss of data 5. Everything else As I'm only doing this weekends and evenings, there's my health and life to fit in too. So #5 issues are not going to get any attention. This week: #2 but iff our secret generation isn't strong enough to prevent impersonation; maybe a #1. And of course as my commit log is public, I'll leave it to the AI tools to work out what I've fixed. Or at least told the AI tools to fix while I went out and did things. Maybe this is just a sudden uptick in vulnerabilities and once they've been discovered things will get quiet. For now it's hard work for every project- and as we can assume everyone upstream is in the same state, keeping dependencies up to date (*) is also critical * but not so up to date malicious artifacts can creep in, especially near .js and .py modules. https://lnkd.in/ei7MrT24

favicon

LinkedIn (www.linkedin.com)

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116465487313090938https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116465487313090938Sat, 25 Apr 2026 13:05:03 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 12:10:52 GMT]]>@frox @bagder @kkarhan When AI was new lots of people screamed how good it was and when I tried it myself on anything nontrivial, it sucked. Nowadays you mostly hear (at least on Mastodon) how bad it is, and when I try it myself I think "holy shet, that is getting really good, wonder where this will be in another year".

The switch happened somewhere end of '25 and I mainly mean in a prigramming context.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/ponygol/statuses/116465274242437696https://board.circlewithadot.net/post/https://chaos.social/users/ponygol/statuses/116465274242437696Sat, 25 Apr 2026 12:10:52 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 11:42:55 GMT]]>@bagder @kkarhan oh, so are you saying the LLM generated (security) issues you're seeing have gotten to be high quality ?
I had understood the previous state was a barrage of legit looking LLM issues that fell apart once you start going through them

]]>https://board.circlewithadot.net/post/https://tooting.ch/users/frox/statuses/116465164300273845https://board.circlewithadot.net/post/https://tooting.ch/users/frox/statuses/116465164300273845Sat, 25 Apr 2026 11:42:55 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 10:25:57 GMT]]>@bagder I wish I could make my org understand that just by buying licenses from Red Hat does not mean that every OSS software we use in our stack is properly supported financially. This is not Flattr and I sometimes get the feeling they think that's how it works. The only thing my org cares about is SBOMs for DORA from OSS projects. I'll continue to sound the drum around this topic!

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/moritzdietz/statuses/116464861662658196https://board.circlewithadot.net/post/https://mastodon.social/users/moritzdietz/statuses/116464861662658196Sat, 25 Apr 2026 10:25:57 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:44:32 GMT]]>@kkarhan our current challenge is a high volume high quality flood.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464698819371942https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464698819371942Sat, 25 Apr 2026 09:44:32 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:31:56 GMT]]>@kkarhan @OS1337 you think we should just flat our refuse to fix obvious bugs because AI was involved in detecting the problem? Even when it now stares us in the face? How would that even work? Should we keep a list of bugs we cant' fix because no human has yet found them manually?

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464649243971111https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464649243971111Sat, 25 Apr 2026 09:31:56 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:29:50 GMT]]>@aris @bagder we're actually seeing new stuff, but often with wildly overexaggerated CVE scores

Them "This gives me an RCE on an application. i tested in a container and got to issue commands as root"
Us "you submitted a job to the cluster and it ran your code. You've just discovered a very convoluted way to execute something you could have done more easily"

What it is doing is really encouraging us to point the AI tooling at old code and say "cut it". It's happy to prune stuff that's been neglected and is no longer needed, and that so simplifies our life

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116464641043161722https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116464641043161722Sat, 25 Apr 2026 09:29:50 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:23:36 GMT]]>@kkarhan I wish it was because of what I did, but it is not. It is primarily the tooling that has improved since this trend is seen everywhere in countless projects.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464616490905282https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464616490905282Sat, 25 Apr 2026 09:23:36 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:23:13 GMT]]>@bagder @kkarhan high-quality slop

]]>https://board.circlewithadot.net/post/https://deadinsi.de/users/cybertailor/statuses/116464614979717527https://board.circlewithadot.net/post/https://deadinsi.de/users/cybertailor/statuses/116464614979717527Sat, 25 Apr 2026 09:23:13 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:22:21 GMT]]>@bagder yehmah, because your non-tolerance made it pretty clear that you "[…] don't have time for this shit! […]

]]>https://board.circlewithadot.net/post/https://jorts.horse/users/kkarhan/statuses/116464611612506865https://board.circlewithadot.net/post/https://jorts.horse/users/kkarhan/statuses/116464611612506865Sat, 25 Apr 2026 09:22:21 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:03:51 GMT]]>@kkarhan again: we see almost no AI slop anymore. That was in the past. Current submissions are usually high quality.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464538811049172https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116464538811049172Sat, 25 Apr 2026 09:03:51 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 09:01:16 GMT]]>@bagder I literally & anyone publicly who shoves that shit towards me.

  • At least I find and test any exploits and bugs manually before I'd even think about filing anything…
]]>https://board.circlewithadot.net/post/https://jorts.horse/users/kkarhan/statuses/116464528699609583https://board.circlewithadot.net/post/https://jorts.horse/users/kkarhan/statuses/116464528699609583Sat, 25 Apr 2026 09:01:16 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 08:56:03 GMT]]>@stevel @bagder Assume the maintainers have received the same bug report 3 times before already and haven't published the fixes yet

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/aris/statuses/116464508194688814https://board.circlewithadot.net/post/https://infosec.exchange/users/aris/statuses/116464508194688814Sat, 25 Apr 2026 08:56:03 GMT<![CDATA[Reply to Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload. on Sat, 25 Apr 2026 08:40:30 GMT]]>@bagder also, when you do submit a security report
- don't expect an immediate response
- don't expect the responders to be in a good mood, especially if its a w/e
- don't pretend it's your work when the report is written the way every other AI generated report is.
- do expect a harsh dismissal if the attack tree requires privileged local disk write access or similar as a step in the attack

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116464447037448719https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116464447037448719Sat, 25 Apr 2026 08:40:30 GMT