What the Two Cultures Are
The discovery culture refers to the ecosystem where researchers find vulnerabilities by craft and are rewarded with reputation and bounties; the disclosure culture refers to the collaborative norms hammered out over years among vendors, researchers, and the CVE system. AI's impact on the former is capacity: automated tools can mass-produce suspected vulnerabilities, mixed with a great deal of false positives and "AI hallucination vulnerabilities," directly flooding the processing pipelines of bounty platforms and maintainers. Its impact on the latter is trust: when a report might be mass-generated by AI, the maintainers who by convention take every report seriously are the first to be worn down.
The Consequences Already Visible
The curl maintainer's public griping about AI junk reports is still fresh, and now it's the daily reality of every well-known open-source project. Some projects have begun requiring reports to come with a reproducible proof of exploit, and bounty platforms have raised the submission bar—defensive measures that at the same time deter sincere newcomers, and the community's openness is contracting. The article's conclusion is pessimistic but fair: the old vulnerability culture was built on the premise of "scarce reports, sincere submitters," and now that this premise is gone and the new norms haven't yet grown in, this in-between window is the most dangerous.
via: Hacker News