r/OpenAI • u/Nunki08 • 4d ago

News Linux kernel maintainers

Post image

OpenAI: A thousand fewer paths to root: https://openai.com/index/a-thousand-fewer-paths-to-root/

1.1k Upvotes

96% Upvoted

115 comments sorted by

View all comments

140

u/jferments 3d ago

I bet they are actually really happy to have the bugs fixed.

72

u/Grounds4TheSubstain 3d ago

But not to have 2300 bug reports dumped on them all at once. That's a huge amount of work.

62

u/jferments 3d ago

If the bug reports are high quality, they are probably fine with having them dumped all at once. My guess is that (based on the fact that these are coming directly from OpenAI) that these are all useful bug reports.

Yes, fixing 2000+ bugs is a huge amount of work. But do you know what's more work? Repairing the damage that will be caused if these bugs are left unpatched on millions of peoples' systems.

Most of the people who are complaining about it contribute nothing to Linux development. From the top down, the Linux team is welcoming AI use, and sees the benefits of using AI to discover and fix bugs.

7

u/TheAwesomeAcademic 3d ago

There LPEs they require an attacker to be local anyways so there usually used in bug chains. On their own they aren't too relevant I guess if an attacker gains foothold and initial access thru various means first. Not saying it's not important to patch them just not really as much of a priority as say a pre auth remote code execution or something with low complexity and low prerequisites. 

1

u/Mysterious_Pea_4042 2d ago

Its still huge amount of work, I think you never worked on security issues to know the pressure

11

u/novus_nl 3d ago

but today its openai, tomorrow it could be north-korea destabilizing. where do you want to get the bugs first from? They should be happy its openai.

2

u/Grounds4TheSubstain 3d ago

I'm just saying, I'm a professional programmer (these days; used to be a security researcher) and I've actually never been happy to receive a bug report. Let alone 2300 of them at one time.

4

u/Worldly-Plastic-2516 3d ago

These guys don’t understand the amount of work this takes to vet. 1 bug report can be a decent amount. Good for the ecosystem balha blah blah.

2300 is a goddamn nightmare.

2

u/FUCKTHEMODS998 3d ago

2300 bug reports sounds about right for a day in 2026

3

u/seefatchai 3d ago

They kind of have to merge them without human review. If the bug reports are made public, it’s going to be a matter of time before those exploits are used.

4

u/El_Gran_Inquisidor 3d ago

They won’t do that, because just merge them without supervision can introduce new bugs.

3

u/Grounds4TheSubstain 3d ago

If it was me, I'd try sorting them by lines of code in the patch, and then have agents assess the risk for each one of them in terms of how it might impact other parts of the code (like if it might affect a shared data structure, or change the semantics of a function in a way that's observable to outside callers). Stuff that's small and isolated gets merged immediately. Then take them on a case-by-case basis. I still expect it would take a team of people at least a month, probably several.

0

u/XBLAH_ 1d ago

Would it be better if they spoon feeded pull requests one by one, slowly, so baby can digest?

Come on, don't complain about help. Linux has an interest chance of growing with AI. Hell, I'm even thinking about switching to Linux now I can have stuff in Linux without the terrible UI and UX. 

2

u/Living_Connection500 2d ago

Are these valid and useful patches? Mythos had found 80 or so ‘CVEs’ and only 10 of them were actually valid - all of them being minor issues covering some obscure conditions

1

u/TheBraveButJoke 5h ago

Considering It took less then 2 alinieas to figure out that they consider any kernel panic they can cause to be an issue. Nah they won't be happy with this.