Re: Coordinated Disclosure in the LLM Age

[ROI AI <sales () roiai ca>]

> In case you have forgotten, this discussion *started* with a maintainer 
suspecting that LLM-detected vulnerabilities


I replied to this thread because I reported a dozen issues to OpenStack, which the OP is a VMT lead for.  He has yet to 
claim any of the issues I've reported are invalid or duplicate. I believe people are overclaiming this.  I also believe 
duplicates, when found, are a good sign for prioritization.    



I was also disappointed to see a serious security bug I reported on OpenStack pushed to public.  If I had know that 
would happen, I wouldn't have reported it.  I don't want to be a part of what I feel to be negligent and unprofessional 
activities.  My goal was not credit, but rather to improve the security of OpenStack as I wanted to see it as a 
solution to sovereign cloud.  Pushing it to public undermined that.

 
Using LLMs, I am farming careless engineers who reveal security sensitive info in bug reports, commit comments, and 
code reviews.  This 'public' attitude is just making it much easier for me to do so.


Security sensitive communication should remain in a restricted discussion area and teams should be using LLMs to 
analyze it for further issues to close.




-- Jacob
Confidential communication. No warranties or commitments unless in a signed agreement. If received in error, notify 
sender and delete. Unauthorized use prohibited.