Linux security mailing list 'almost unmanageable'
Linus Torvalds 表示，Linux 内核安全邮件列表因为 AI 工具带来的大量重复漏洞报告，已经"几乎完全失控"。在他每周的内核状况更新中，他解释说，很多研究者用相同的 AI 工具去发现相同的漏洞，造成大量重复条目，邮件列表被冗余报告淹没。他将因此产生的那类讨论——把报告转给相关维护者或指出漏洞已修复——称为"毫无意义的空转"，浪费大家的时间。
Torvalds 认为，AI 发现的漏洞本质上并不是什么秘密，把它们放在私人安全列表里处理反而适得其反。他指出，这种做法会加剧重复报告的问题，因为报告者看不到彼此的提交，导致同一问题被反复上报。他提醒内核贡献者查阅项目文档，文档中已有相关说明，尽管他承认自己的措辞"比书面指导稍微委婉一些"。
尽管对 AI 报告的处理方式感到沮丧，Torvalds 也承认 AI 工具若被恰当使用仍然有价值。他敦促研究人员不要只把 AI 生成的结果原封不动地转发，而应通过阅读文档、提交补丁，并在 AI 发现的基础上提供有意义的分析来创造真正的价值。他特别批评那些没有深入理解就随意提交报告的"路过式"举报者，要求他们在贡献时更为慎重。
Torvalds 的评论与同为内核维护者的 Greg Kroah-Hartman 最近的说法形成对比。后者在接受 The Register 采访时表示，AI 已成为开源社区越来越有用的工具。虽然 Kroah-Hartman 指出 AI 生成的漏洞报告质量有所提升，Torvalds 的不满则凸显了在安全研究中广泛采用 AI 所带来的成长阵痛，尤其是在协调与避免重复工作方面。
Linus Torvalds has declared that the Linux kernel security mailing list has become "almost entirely unmanageable" due to a flood of duplicate bug reports generated by AI-powered tools. In his weekly state of the kernel post, he explained that multiple researchers are using the same AI tools to find the same bugs, creating enormous duplication and overwhelming the list with redundant reports. He described the resulting chatter, where people forward reports to the right maintainers or point out that bugs were already fixed, as "entirely pointless churn" that wastes everyone's time.
Torvalds argued that AI-detected bugs are by definition not secret, so treating them on a private security list is counterproductive. He pointed out that this approach only makes duplication worse because reporters cannot see each other's submissions, leading to the same issues being reported repeatedly. He directed kernel contributors to the project's documentation, which addresses this problem, though he admitted his own assessment was "a bit less blunt" than the written guidance.
Despite his frustration with how AI bug reports are being handled, Torvalds acknowledged that AI tools can be valuable if used productively. He urged researchers to go beyond simply forwarding AI-generated findings and instead add real value by reading the documentation, creating patches, and contributing meaningful analysis on top of what the AI discovered. He specifically called out "drive-by" reporters who send random reports without real understanding, asking them to be more thoughtful in their contributions.
Torvalds' comments stand in contrast to recent remarks from fellow kernel maintainer Greg Kroah-Hartman, who told The Register that AI has become an increasingly useful tool for the open-source community. While Kroah-Hartman has noted the improvement in quality of AI-generated bug reports, Torvalds' frustration highlights the growing pains that come with widespread AI adoption in security research, particularly around coordination and avoiding redundant efforts.
102 comments • Comments Link
讨论的焦点是一波针对 Linux 内核邮件列表的 AI 生成垃圾邮件：一位名为 "Marian Corcodel" 的用户反复发布了 26 MB 大小的无意义补丁，疑似意在污染 LLM 的训练数据。人们担心这类大体量消息会给基础设施造成压力，计算显示即便点击率适中也可能压垮服务器，尽管压缩和现代带宽在一定程度上缓解了风险。
更广泛的问题是大量重复的 AI 生成漏洞报告，Linus Torvalds 抨击这是毫无意义的"虚假工作"，让维护者不堪重负。有人认为 AI 可以成为发现真实漏洞的有力工具，但缺乏去重机制和激励约束导致效率极低。为此提出的对策包括用 AI 做分类与重复检测、为 AI 生成的报告设立独立队列，或要求匿名以消除个人动机。争论还涉及邮件列表与论坛的利弊：支持者称赞邮件列表高效、开放且可由用户自定过滤，批评者则觉得它们复杂且不易上手。总体上，社区在权衡 AI 在安全研究中的潜在好处与其带来的噪音和资源成本时陷入两难，普遍认为应当开发更好的工具和流程来管理涌入，而不是彻底否定这项技术。 The discussion centers on a wave of AI-generated spam targeting the Linux kernel mailing lists, with a user named "Marian Corcodel" repeatedly posting 26MB nonsensical patches, possibly to poison LLM training data. Concerns are raised about the strain such large messages place on infrastructure, with calculations suggesting even modest click volumes could overwhelm servers, though compression and modern bandwidth mitigate some risk. The broader issue is the flood of duplicate, AI-generated security bug reports, which Linus Torvalds criticized as unproductive "make-believe work" that overwhelms maintainers. While some argue AI can be a useful tool for finding real bugs, the lack of deduplication and the incentive for self-promotion lead to massive inefficiencies. Suggestions include using AI for triage and duplicate detection, creating separate queues for AI-generated reports, or requiring anonymity to remove personal incentives. The debate also touches on the merits of mailing lists versus forums, with defenders praising their efficiency, openness, and user-controlled filtering, while critics find them convoluted and inaccessible. Ultimately, the community grapples with balancing the potential benefits of AI in security research against the overwhelming noise and resource costs it introduces, with a consensus forming around the need for better tooling and processes to manage the influx without dismissing the technology entirely.