oss-security reply doubts a separate list would end vulnerability volume
Original title: Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Jan Schaumann says reporting stays cheaper than analysis, fixes, and long-term software maintenance.
On October 18, Jan Schaumann replied on oss-security to a proposal for a separate vulnerability-reports list tied to AI findings. He said the idea effectively assumes software vulnerabilities will almost disappear, which he does not expect. He pointed to the cost gap between identifying and reporting issues and analyzing, fixing, and maintaining software.
- Schaumann does not expect security vulnerabilities in software to largely stop.
- He contrasts cheap reporting with the cost of analysis and fixes.
- He also cites development, infrastructure, support, and human maintenance costs.
From the original article
Posted by Jan Schaumann on Oct 18 Martin Steigerwald wrote: This sounds akin to proposing that, effectively, there will be (almost) no more security vulnerabilities in our software. I don't see that happening.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.