Re: Retrospective by 'gpg.fail' authors
oss-security thread on the gpg.fail retrospective discusses legacy code removal and flaws surfaced by frontier AI models in open-source projects.
In a reply to Soatok Dreamseeker's gpg.fail retrospective thread on the oss-security mailing list, cryptographer Peter Gutmann argues it is often unclear which legacy code is obsolete or can be safely removed. He recounts a discussion with another well-known open-source project developer estimating, unscientifically, that around half of issues in such projects were found by frontier AI models. The exchange reflects on lessons from documenting weaknesses in GnuPG/OpenPGP implementations.
- Peter Gutmann replies to the gpg.fail retrospective on oss-security
- Anecdotal estimate: roughly half of issues in a well-known OSS project found by frontier AI models
- Discusses difficulty of determining which legacy crypto code is safe to remove
From the original article
Posted by Peter Gutmann on Sep 16 Soatok Dreamseeker writes: https://xkcd. com/1172/ there's the secondary problem that it's not clear which code is obsolete and/ or can be safely removed. I was recently talking with the developer of another well-known OSS project on issues found by frontier AI models in them and we both mentioned that, totally unscientifically, around half of all issues...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.