So the Linux Foundation and a wide range of companies have launched "Akrites" to deal with the vulnerability deluge:

https://akrites.org/letter/

I do wonder though ... "confidentiality" is at the core of this whole thing - keeping vulnerabilities secret until fixes are deployed. When you have LLMs discovering the vulnerabilities, though, they are not secret. Trying to treat them as if they were might well just slow down the process of getting fixes out and make things worse. Embargoes and confidentiality seem like an attempt to perpetuate the last decade's approaches beyond their time.

@corbet in reality, once the low-hanging fruits (of which there are of course a non-negligible number) are dealt with, mere access to even frontier LLMs is just not enough. You need someone actually knowledgeable with the project in scope providing _really_ good prompts, and careful guidance, to get these things to produce actual issues. Otherwise at best you get a bunch of hardening bug fixes that have no real impact. Just assuming anybody can find anything by just asking claude is simplistic.

@bluca @corbet yeah, based on the pile of these reports I've filtered through now, the number of reports that would make sense on one project but not another and get reported anyway is very high. The signal-to-noise ratio is impressively bad.

@corbet To my mind having them private for long enough for the maintainers to spot if there are any similar issues makes sense.

@corbet

> Embargoes and confidentiality seem like an attempt to perpetuate the last decade's approaches beyond their time.

this has been my impression, as well. like why not go in the exact opposite direction: full disclosure on discovery?

Put out the disclosure, along with at least a PoC fix patch set, as soon as possible.

Would allow upstream to have a much better position for applying the fix, even if it needs to be massaged a bit. Would also allow users to apply the patch to forks.

@corbet I don't have much of an opinion about embargoes. But "This approach provides one confidential, trusted place to coordinate discovery, remediation, and disclosure" is I'm afraid giving me "there are 14 competing standards" vibes. (Arguably unfairly, but I can't resist)