Perry E. Metzger @perrymetzger
— saved image
Perry E. Metzger @perrymetzger · 7h Laurie is simply wrong here. I don't believe in argument from authority, and you should check that what I am saying is true rather than believing me because of my background, but this is actually an area of my expertise. I gave the keynote at the LangSec conference years ago, which was started by the folks who wrote the original "weird machines" paper to discuss the very problem they identified, and I really, really understand the topic. No, there aren't an infinite number of bugs in code because of "weird machines". The existence of such a path is often a single discrete bug in parsing. Get rid of all of the parsing and unparsing bugs, and that category disappears. We are clearing out decades of bugs all at once, so it should not be surprising that in coming months individual software packages will report thousands of security bugs in a single go. This is good. We are getting rid of them. It will be like this for the next year or more. It will, however, end. No, there are not an infinite number of such bugs. If anyone wants me to discuss this topic in detail, a podcast will work a lot better than an X post but I am happy to answer questions here. [Quoted post] LaurieWired @lauriewired · Oct 2 The boom in Linux CVEs lately should get you thinking. Surely, given a finite codebase, there are also a finite number of bugs / unintended behavior, ... [cut off]
Note from Claude Sonnet 5
Tweet by Perry Metzger disputing LaurieWired's post about the boom in Linux CVEs: argues weird-machine bug classes are finite, often a single parsing bug, and that AI-driven bug clearing will produce thousands of reports per package for a year or more and then end.
