CIRCLE WITH A DOT

@ariadne @thesamesam @lanodan yeah that's obviously the end goal of all this wild and absurd speculation, but capitalism gotta capitalism. At some point the bubble will pop and then we'll see what's left standing

@lanodan @ariadne @thesamesam the 70% of valid-bugs-but-not-vulnerabilities is kinda 50-50 our fault and the bots fault. The bots fault because it's a dumb LLM in the end, it doesn't understand the big picture (well doesn't "understand", full stop). Our fault because a lot of the security models are pretty much implicit, and scarcely documented if at all, so the bot has nothing to keep it grounded to reality

@lanodan @ariadne @thesamesam our security bug bounty in systemd was 99.99% garbage until end of last year. Since then these tools have got way better, and I'd say there's a ~10% valid security bugs, ~70% valid bugs but not security relevant, and ~20% garbage. I'll happily take the 10% of real, valid issue found for the price of having to shoot down ~20% of garbage. The key is to have no mercy - there's no arguing or bargaining involved, a crap report gets binned, end of, no discussions

@ariadne @thesamesam @lanodan of course and stuff like that gets shot into the sun with a rocket without mercy.

But you don't argue with chatbots in reviews - these days claudebot is about 90% signal-to-noise ratio. The 10% noise you just dismiss, there's no arguing involved. But that 90% of signal has got really good in the past ~3 months, and there's no point denying it. This stuff was mostly crap until end of last year, but things change, and there's nothing wrong with changing views

@thesamesam @lanodan @ariadne and I'm pointing out that the distinction is specious and a glaring case of double standards. Everyone uses who uses these tools does so in different ways, and you don't get to do moral grandstanding just because you arbitrarily drew a line in the sand where it's most convenient for you, and not a millimeter further. Doesn't work that way, sorry

@thesamesam @lanodan @ariadne gotcha, rules for thee but not for me

@thesamesam @astraleureka @lanodan @ariadne yeah sure, if you exclude some tiny details like, er, SMP support https://lists.gnu.org/archive/html/bug-hurd/2026-02/msg00133.html

Enjoy your single-core UNTAINTED systems forever, I guess?

@thesamesam @lanodan @ariadne

Hurd using LLMs for reviews: perfectly ok
systemd using LLMs for reviews: TAINTED

DId I get this right?

@ariadne there's no "if", the kernel does use LLMs extensively, right now: https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/ precisely and exactly the same policy as systemd has. LIterally the same. And yet these lunatic takes never demand Linux distros drop Linux. I wonder why ¯\_(ツ)_/¯