Post #3554231

2026-07-03 10:23 UTC

It seems the AI slop issues for fwupd just slowed down after all the Mythos fixes went in, rather than stopped. I guess we need to document that low severity "theoretical" security issues found using AI without a reproducer are not going to get CVEs. Does anyone see any problem in something like: https://github.com/fwupd/fwupd/pull/10604/changes -- it's wildly opinionated but perhaps pragmatic. Opinions welcome.

Replies (3)

@jti42@infosec.exchange 2026-07-03 12:40

@hughsie@mastodon.social That reads like a useful & sane PR addition.

Open ##3556277
@bluca@fosstodon.org 2026-07-03 10:28

@hughsie@mastodon.social looks great, and pretty much matches the policy we use in systemd

Open ##3621374
@wall_e@ioc.exchange 2026-07-03 11:47

@hughsie@mastodon.social on the fence about the usefulness of the "include fix" clause. Do you think you'd really get meaningful fixes out of it that you could merge as-is? Cause in reality, I'd expect many of the non-obvious bugs that remain in highly scrutinized projects like fwupd, to require fixes that carry a lot of potential side-effects. And it may actually be harder to reason about those in a review for a fix that was spit out by an LLM, as opposed to thinking through the problem from the start. Then again, if your test suite is good enough, a fix that passes all tests should be fine to merge I guess 🤔

Open ##3621384