Daniel P. Berrangé <[email protected]> writes: > Recently QEMU has received a denial of service attack on > its bug tracker in the form of 120 reports in 10 minutes, > and now repeated by another reporter in the form of 50 > reports in the same day. > > Prior to switching security disclosures to the bug tracker, > single reporters have submited 18, 22, and 114 bug reports. > > None of this is sustainable. It is an effective denial of > service attack on the project maintainers' time. Every bug > report is a TODO item added to someone's workload. > > It is time to put hard limits on how many bugs, discovered > with assitance of automated tools, we are willing to accept > in a givenm time frame. > > This patch proposal suggests > > * No more than 5 bugs per week, per reporter > * No more than 10 bugs are permitted to be open at any > time, per reporter. > > This is explicitly scoped to bugs discovered with the assistance > of automated tools. Bugs where a human puts in exclusively > personal time / effort to discover a problem are not limited. > > Signed-off-by: Daniel P. Berrangé <[email protected]> > --- > contribute/report-a-bug.md | 37 +++++++++++++++++++++++++++++++++++++ > 1 file changed, 37 insertions(+) > > diff --git a/contribute/report-a-bug.md b/contribute/report-a-bug.md > index b506f9f..8fb7b0b 100644 > --- a/contribute/report-a-bug.md > +++ b/contribute/report-a-bug.md > @@ -32,6 +32,43 @@ on GitLab, taking into account the following guidance. > triage of their output to validate all findings and reproducer > scenarios prior to submitting a bug report. > > +* QEMU policy forbids the bulk filing of large numbers of > + bug disclosures that were generated with automated tools > + (AI/LLM, static analysis, fuzers). Such actions are not
fuzzers > + a benefit to the project, placing an unsustainable burden > + on maintainers. [...]
