AI found 12 OpenSSL zero-days(lesswrong.com)

24 pointsby theptip5 maanden geleden1 comments

https://www.lesswrong.com/posts/7aJwgbMEiKq5egQbd/ai-found-12-of-12-openssl-zero-days-while-curl-cancelled-its

1 comments

AI at once enables so much slop that it kills open bug bounty programs and at the same time finds actual problems. How can we enable the sorts of benefits that AI brings, like this awesome security work but block the slop that floods PR pipelines with bullshit?

AI will either have to be developed to validate these low value PR, or we need to block the slop. I propose that AI use be licensed and AI users have to provide proof of age, so to submit to these open ended bug bounty programs, the AI user has to upload a picture of a valid photo ID and post a $100 deposit with the bug bounty program, refundable upon finding a valid issue, if the issue submitted by the licensed AI user is bogus and low quality, their license is revoked and the key to their AI installation and / or access will be removed and they then have to attend a "defensive AI driving course" before submitting an application to be licensed and of course they forfeit their previous deposit and have to post another $100.

This post may contain errors.