Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)

["David A. Wheeler" <dwheeler () dwheeler com>]

> On Jun 13, 2026, at 6:32 PM, Solar Designer <solar () openwall com> wrote:
> ...
>
> On Mon, Jun 08, 2026 at 07:46:07PM -0400, David A. Wheeler wrote:
> > All: I propose that we create a *separate* mailing list, say
> > "oss-security-vulnerability-reports", for run-of-the-mill vulnerability reports
> > about open source software (OSS). Run-of-the-mill reports would then go there
> > and *not* to this mailing list "oss-security". This would leave *this* oss-security" mailing list
> > for general discussions about the topic of OSS security, including discussions about
> > specific publicly known vulnerabilities that are especially noteworthy in some way.


> I do indeed see the problem, but I don't like the proposal.  Also, for
> now the increased volume on this list hasn't exceeded its historical
> pre-AI peak: we had 485 messages in October 2014, but 455 in May 2026.
> I'm not seeing a mass exodus of subscribers either.  There's greater
> churn - more people are leaving, but at the same time more are joining.

Fair point. I'm primarily anticipating the future.

> Just by saying to no longer send run-of-the-mill vulnerability reports
> in here, we won't instantly achieve that.  Sure the moderators can stop
> and re-route them, but that's not an easy job.  It's tricky to draw the
> line between run-of-the-mill and noteworthy.

That's true. However, since it's *not* instant, it might be better to try to
"get ahead of the curve". But that's simply my suggestion; you're running the list.


> Rather than tell people to send something to the other list, I ask this:
>
> Whenever practical, please group related vulnerability disclosures into
> fewer messages (like security advisories) and use helpful Subject lines.
> Include the project name in a fixed place near the beginning of Subject,
> and make the Subject specific to the one disclosure rather than generic
> shared between multiple disclosures.

Ok, sure, let's try that first. That is certainly easy to ask for. I have concerns
that this measure won't be enough long-term, but I guess we'll see.

I suspect we're going to see at least a two-orders-of-magnitude increase
in the number of monthly reported vulnerabilities within the next two years.
That's because AI is greatly reducing the effort needed to find vulnerabilities.
Eventually it'll taper off, but I expect we'll have to weather the storm first.
If things do get overwhelming, please reconsider.

That said: predicting the future is hard. I would be delighted to proven wrong :-).

--- David A. Wheeler