Compared to the current state, where multiple "security researchers" independently send unsolicited identical reports, this feels like the right solution:
1. It's opt-in, anyone that doesn't want to receive these reports, or has reasons to not want AI used on their project gets that by default.
2. It's free for OSS projects, many of us won't spend money for a hobby we work on in our spare time and give away.
3. The reports go back to the maintainer, and not to potential attackers.
I would like to see more locally run models in this space, breaking the dependency on SaaS vendors. Even though those local models can't be controlled and would therefore be used by attackers. At some point, we'll get past this wave of newly discovered issues that have been lurking in the code for years, and the scans should run like any other linter or dependency checking tool.
Sure frontier models can continuously scan projects for vulnerabilities, but projects written in memory-unsafe languages (i.e. C) require an endless cycle of discovery, triage, and remediation as new features are built.
Just wait a couple more years, I am betting that it will be economically preferable to migrate software onto memory-safe languages and more verifiable architectures rather than repeatedly auditing systems built on fragile code.
If they truly wanted to do good, an "OSS Rewrite" service is a natural logical successor to vulnerability scanning. Instead of spinning wheels and burning tokens finding bugs in unsafe code, it would probably make more sense for AI to help move projects onto platforms where entire classes of vulnerabilities are just eliminated.
2 comments
[ 0.24 ms ] story [ 8.6 ms ] thread1. It's opt-in, anyone that doesn't want to receive these reports, or has reasons to not want AI used on their project gets that by default.
2. It's free for OSS projects, many of us won't spend money for a hobby we work on in our spare time and give away.
3. The reports go back to the maintainer, and not to potential attackers.
I would like to see more locally run models in this space, breaking the dependency on SaaS vendors. Even though those local models can't be controlled and would therefore be used by attackers. At some point, we'll get past this wave of newly discovered issues that have been lurking in the code for years, and the scans should run like any other linter or dependency checking tool.
Sure frontier models can continuously scan projects for vulnerabilities, but projects written in memory-unsafe languages (i.e. C) require an endless cycle of discovery, triage, and remediation as new features are built.
Just wait a couple more years, I am betting that it will be economically preferable to migrate software onto memory-safe languages and more verifiable architectures rather than repeatedly auditing systems built on fragile code.
If they truly wanted to do good, an "OSS Rewrite" service is a natural logical successor to vulnerability scanning. Instead of spinning wheels and burning tokens finding bugs in unsafe code, it would probably make more sense for AI to help move projects onto platforms where entire classes of vulnerabilities are just eliminated.