2026-10-02T05:24:03Z https://nostr.now Jed Brown https://nostr.now/npub1466v6757um9psdj7z08dty33ulxq9azkhk3ecdxrhxpm09drzsks7cp862 https://media.neuromatch.social/accounts/avatars/117/335/250/292/173/631/original/1477189b43157217.png https://media.neuromatch.social/accounts/avatars/117/335/250/292/173/631/original/1477189b43157217.png https://nostr.now/nevent1qqsr76t2ypxrw2qh88fmcv0jh9pank8wcca5vpz3938cyxxw84wgxcszyzhtfnt6nmnv5xpktcfua4vjx8nucqh5267688p5cwuc8du45v2z6xxzwlm <br/><br/>We all hate this<br/><br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqhfelzemwrvxxpd7qqfr3m3a7mv4nmf9ydjdnfk83lj6zuhdqmlmszlma7m" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Greg K-H</span> (<span class="italic">nprofile…ma7m</span>)</a></span> dropping necessary bombs about LLMs in Linux security and development.<br/><br/><a href="https://www.youtube.com/watch?v=NnV_cWeoo5Q">https://www.youtube.com/watch?v=NnV_cWeoo5Q</a><br/><br/>The purported 79 vulnerabilities were mostly bogus (not a bug, fabricated data) or had already been patched; the few real (all very minor) bugs took him an hour to fix. He says &#34;do not panic&#34;, and emphasizes that time to apply patches is the main vulnerability these days (not an LLM problem).<br/><br/>&#34;These are pattern-matching tools&#34;, &#34;they do not have intent&#34;. (Vindicating to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqe0a6n84krygh2qc3ajptu4fa4ma0qy53acz8smsyhztgxljxkghsk25876" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqe0a6n84krygh2qc3ajptu4fa4ma0qy53acz8smsyhztgxljxkghsk25876</span> (<span class="italic">nprofile…5876</span>)</a></span> and <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqrhr0y4vaqskyq2qejhquzq90yr586hf948m3cgxd7pcqamg4l8cqyg97y5" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqrhr0y4vaqskyq2qejhquzq90yr586hf948m3cgxd7pcqamg4l8cqyg97y5</span> (<span class="italic">nprofile…97y5</span>)</a></span> re &#34;stochastic parrots&#34;; it was accurate at the time and accurate today, protestations from boorish AI boosters notwithstanding.)<br/><br/>New code is 50% wrong, generated code is littered with new vulnerabilities; need to reject a lot but believes review processes are adequate to prevent a shipping a flood of LLM-generated vulnerabilities.<br/><br/>High false-positive rates make the models incredibly irritating. Cf. Coverity&#39;s post-mortem with a deterministic tool that had low false-positive rates.<br/><br/>Push back hard [on corporate marketing to developers]<br/><br/>With regard to higher CVE rates:<br/><br/>We&#39;ll grind it down like we did with the fuzzers.<br/><br/>If you want to look for bugs with an LLM (which amounts to fuzzy pattern-matching), use a local model and never upload to platforms.<br/><br/>I have banned LLMs from driver staging, unless you have the hardware and can prove you have tested the patch. That&#39;s not what staging is for. Staging is to learn how to do development and get involved with our community. [...] Kernel development is all about trust. If I take patches from you and I don&#39;t know who you are, now I am responsible for that patch. [...] You need to build up trust.<br/><br/>It&#39;s put a lot of additional burden on us, as maintainers. 2026-10-03T03:39:04Z