While I see the temptation and the logic up to a point, dropping a 0-day
on a small project is not helping anyone. It *could* be discovered by a
LLM by another person, but that doesn't mean they are actually looking.
Large, popular projects are more likely to get widely scanned. Smaller
projects may not. I wouldn't expect 90 days but a few would be nice.
If someone is reporting to me that there is a vulnerability in a piece
of software, even if I use AI to fix it, I'm still going to need time to
test it before doing a release. The release process takes a few hours
for me. Then the test and patch time.
Pretend for a moment that you maintain a small project as a hobby. You
have a day job. Suddenly, a CVE is dropped on your lap mid day. You
didn't make anyone safer doing that. It's not like I'm going to get it
patched during work hours. Not everyone is Red Hat or Apple.
This happened recently to the rsync project. It could have waited a few
days to go public.
At a minimum, if you're going to go public, use your AI to include a
possible patch too. Don't just drop work on a random person because you
got to find it first. That's not cool.
--
Lucas Holt
[email protected]
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
