Re: Coordinated Disclosure in the LLM Age

[Lucas Holt <luke () foolishgames com>]

While I see the temptation and the logic up to a point, dropping a 0-day 
on a small project is not helping anyone.  It *could* be discovered by a 
LLM by another person, but that doesn't mean they are actually looking.  
Large, popular projects are more likely to get widely scanned.  Smaller 
projects may not.   I wouldn't expect 90 days but a few would be nice.  
If someone is reporting to me that there is a vulnerability in a piece 
of software, even if I use AI to fix it, I'm still going to need time to 
test it before doing a release.  The release process takes a few hours 
for me.  Then the test and patch time.

Pretend for a moment that you maintain a small project as a hobby. You 
have a day job.  Suddenly, a CVE is dropped on your lap mid day.  You 
didn't make anyone safer doing that.  It's not like I'm going to get it 
patched during work hours.  Not everyone is Red Hat or Apple.

This happened recently to the rsync project. It could have waited a few 
days to go public.

At a minimum, if you're going to go public, use your AI to include a 
possible patch too.  Don't just drop work on a random person because you 
got to find it first.  That's not cool.

--
Lucas Holt
Luke () FoolishGames com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)