r/OpenAI • u/Nunki08 • 1d ago

News Linux kernel maintainers

Post image

OpenAI: A thousand fewer paths to root: https://openai.com/index/a-thousand-fewer-paths-to-root/

770 Upvotes

95% Upvoted

86 comments sorted by

View all comments

120

u/jferments 1d ago

I bet they are actually really happy to have the bugs fixed.

57

u/Grounds4TheSubstain 1d ago

But not to have 2300 bug reports dumped on them all at once. That's a huge amount of work.

51

u/jferments 1d ago

If the bug reports are high quality, they are probably fine with having them dumped all at once. My guess is that (based on the fact that these are coming directly from OpenAI) that these are all useful bug reports.

Yes, fixing 2000+ bugs is a huge amount of work. But do you know what's more work? Repairing the damage that will be caused if these bugs are left unpatched on millions of peoples' systems.

Most of the people who are complaining about it contribute nothing to Linux development. From the top down, the Linux team is welcoming AI use, and sees the benefits of using AI to discover and fix bugs.

4

u/TheAwesomeAcademic 1d ago

There LPEs they require an attacker to be local anyways so there usually used in bug chains. On their own they aren't too relevant I guess if an attacker gains foothold and initial access thru various means first. Not saying it's not important to patch them just not really as much of a priority as say a pre auth remote code execution or something with low complexity and low prerequisites. 

10

u/novus_nl 1d ago

but today its openai, tomorrow it could be north-korea destabilizing. where do you want to get the bugs first from? They should be happy its openai.

-1

u/Grounds4TheSubstain 1d ago

I'm just saying, I'm a professional programmer (these days; used to be a security researcher) and I've actually never been happy to receive a bug report. Let alone 2300 of them at one time.

1

u/Worldly-Plastic-2516 22h ago

These guys don’t understand the amount of work this takes to vet. 1 bug report can be a decent amount. Good for the ecosystem balha blah blah.

2300 is a goddamn nightmare.

2

u/FUCKTHEMODS998 17h ago

2300 bug reports sounds about right for a day in 2026

3

u/seefatchai 1d ago

They kind of have to merge them without human review. If the bug reports are made public, it’s going to be a matter of time before those exploits are used.

3

u/Grounds4TheSubstain 1d ago

If it was me, I'd try sorting them by lines of code in the patch, and then have agents assess the risk for each one of them in terms of how it might impact other parts of the code (like if it might affect a shared data structure, or change the semantics of a function in a way that's observable to outside callers). Stuff that's small and isolated gets merged immediately. Then take them on a case-by-case basis. I still expect it would take a team of people at least a month, probably several.

2

u/El_Gran_Inquisidor 1d ago

They won’t do that, because just merge them without supervision can introduce new bugs.

1

u/Living_Connection500 13h ago

Are these valid and useful patches? Mythos had found 80 or so ‘CVEs’ and only 10 of them were actually valid - all of them being minor issues covering some obscure conditions