We currently have three pending CVEs to be announced in the next #curl release (severity low + medium x 2)
All three found with AI powered tooling.
So it is happening.
⇧
We currently have three pending CVEs to be announced in the next #curl release (severity low + medium x 2)
All three found with AI powered tooling.
So it is happening.
shadowwwind
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to shadowwwind • • •Tane Piper ⁂
in reply to daniel:// stenberg:// • • •sijmen (now on iceshrimp)
in reply to Tane Piper ⁂ • • •Tane Piper ⁂
in reply to sijmen (now on iceshrimp) • • •My concern here that LLMs do give worse-than results than something like Sonar - in many cases *static* code analysis was good enough to catch things that LLMs miss.
Ideally we would still use different tools, but GitHub seems to want to push everything into models.
tane.codes/@tanepiper/11567433…
Tane Piper ⁂
2025-12-06 19:44:21
daniel:// stenberg://
in reply to Tane Piper ⁂ • • •Tane Piper ⁂
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Tane Piper ⁂ • • •While hibernating, Svavar
in reply to daniel:// stenberg:// • • •Considering how many garbage AI pull requests you must get, I imagine it's still unclear if the technology is a net positive.
I think it's also important to note that the PRs were reviewed by someone skilled so, while the LLM may have helped, the vulnerabilities were still vetted by a human who understood what was wrong.