The Era of Software Quality, or the Era of Ostriches?
3 hours ago
- Humans, including GNOME developers, are inherently bad at writing secure code in unsafe languages like C, C++, and Vala; AI has improved dramatically and can now effectively find vulnerabilities.
- AI vulnerability scanning is essential for maintaining quality software in 2026; failing to scan projects leaves users vulnerable to attackers who can exploit AI-generated exploits.
- AI-generated vulnerability reports have improved in quality but still suffer from verbosity, exaggeration, occasional fake data; human reviewers are needed but overwhelmed by high volume.
- GNOME maintainers should not ban AI-generated vulnerability reports; projects that do so are unsuitable as dependencies and should be moved out of GNOME GitLab.
- The GNOME bug bounty program (sponsored by Sovereign Tech) uncovered many flaws in libsoup and GLib but was overwhelmed and closed; only 71 of 298 reports were accepted, with low acceptance rate due to financial incentives for poor reports.
- Red Hat's AI scan of GLib found 118 vulnerabilities, but 46 were false positives (typelib issues); overall false positive rate ~40%, but remaining reports were high quality and led to many CVEs.
- Human expertise remains critical: AI failed to discover important findings like Flatpak sandbox escapes; reliance on AI alone is not recommended.
- AI should not be used to write code comments, commit messages, or GitLab posts; human judgment and authenticity are preferred.
- Maintain perspective: security bugs are just bugs; volunteer maintainers are not obligated to fix all issues. Rust reduces memory safety but increases supply chain risk via Cargo; Rust is not recommended for GNOME due to heavy dependency on Cargo.