On 5/24/26 06:58, ROI AI wrote:
> In case you have forgotten, this discussion *started* with a maintainer
suspecting that LLM-detected vulnerabilities
I replied to this thread because I reported a dozen issues to
OpenStack, which the OP is a VMT lead for. He has yet to claim any of
the issues I've reported are invalid or duplicate. I believe people
are overclaiming this. I also believe duplicates, when found, are a
good sign for prioritization.
I was also disappointed to see a serious security bug I reported on
OpenStack pushed to public. If I had know that would happen, I
wouldn't have reported it. I don't want to be a part of what I feel
to be negligent and unprofessional activities. My goal was not
credit, but rather to improve the security of OpenStack as I wanted to
see it as a solution to sovereign cloud. Pushing it to public
undermined that.
Using LLMs, I am farming careless engineers who reveal security
sensitive info in bug reports, commit comments, and code reviews.
This 'public' attitude is just making it much easier for me to do so.
Security sensitive communication should remain in a restricted
discussion area and teams should be using LLMs to analyze it for
further issues to close.
-- Jacob
I want to make clear that the message quoted above bungled quoting in a
way that left my signature line after what I now presume to be a
generated response that completely ignored the point I was trying to
make. I am sorry but I have just run out of credible assumptions of
good faith from ROI AI.
I also note that the list moderator is asking to curtail this thread and
I agree that any further "debate" with the ROI AI slop machine is likely
to be useless. I want the record to clearly show that the *only* piece
of that I wrote was the sentence fragment quoted in its first line: "In
case you have forgotten, this discussion *started* with a maintainer
suspecting that LLM-detected vulnerabilities"
-- Jacob
