Hi Jeff, Jeff Bindel <[email protected]> writes:
> This is secure-by-design hardening (Google Patch Rewards style), not a > security bug report and not a PoC. Thank you for this clarification, and making me aware of this interesting feature. Note, that I am responding as someone who is not a maintainer of GNU tar. However, I would like to make Paul and Sergey, who maintain GNU tar, aware of Lasse Collin's review of your patch submitted to xz-utils. In that patch to xz-utils, an LLM-generated NOTES.md file was included in the commit, likely meaning the code was LLM-generated too. Some projects are okay with LLM-generated patches; others are not for reasons such as copyrightability, for example. I suspect GNU tar is in the latter camp. Regardless, the submission with the LLM-generated report calling out a bug should be a cause for concern for unrelated projects as well. On a more interesting note, you mention "Google Patch Rewards". As Lasse found, it turns out that Google has a list of open-source projects [2] they deem important enough to pay (supposedly) [3] contributors for. It appears the qualifications are fairly lax, e.g., any memory safety issue qualifies so long as it is a "vulnerability". It doesn't say what classifies as a vulnerability [4], but I suspect anything assigned a CVE will do. And CVEs are often assigned for bogus reasons. Included in that list are xz, gzip, GNU tar, and GNU cpio. I was wondering why GNU tar and cpio seem to get so many more LLM-generated "security" submissions, at least based on my estimation from viewing my inbox, than other GNU projects. I guess that answers why. Since I am a maintainer of none of those projects, I won't make too much of a commotion about it. But the system seems designed to encourage spam PRs. I struggle to think of a more charitable interpretation. If their goal was to improve security, I am not sure why they wouldn't fund the projects and longstanding maintainers directly. Collin [1] https://github.com/tukaani-project/xz/pull/245#issuecomment-5640147905 [2] https://github.com/google/bughunters/blob/main/patch-rewards-program/scope.md [3] https://bughunters.google.com/open-source-security/patch-rewards [4] https://bughunters.google.com/about/rules/open-source/patch-rewards-program-rules#open-source-patch-rewards
