Ugh. If this makes my Linux systems less stable, I don’t even know what the fuck I’m going to do. I won’t go back to Windows, I’m not buying Macs (which have their own software problems anyway), and my hardware probably won’t work with any BSD variant.
What Linus is saying that LLM review is finding decades old esoteric bugs in the kernel code, like dirtyfrag. And the amount of bugfixes and mitigations are pushing the update sizes up. This is making the kernel more secure and stable in the long run. It will be just a rocky couple of years.
AI is finding bugs, which are getting fixed. That’s great, it means a more secure and stable system. As these vulnerabilities are patched out, they are gone forever(regressions not withstanding).
Theoretically, Linux could become perfectly secure. It’s not going to stop people from doing insecure things, but it could mean there are no unintended security weaknesses. We could hit a point were an “LTS” copy of Linux never receives a single security patch, because as long as the code isn’t changing, there’s nothing to fix.
Of course, this is all theoretical, and assumes that new classes of attacks or bigger chains for attacks are never found, but vulnerabilities should be a finite resource in a static codebase, and once that resource is fully exhausted, the code is now fully safe.
Ideally, open weights or open source models catch up, and this can all be done without paying a ransom to OpenAI or Anthropic, and is available through the whole stack, not just kernel level.
The same way Windows is “fixing bugs” with AI? Large volumes of dubiously tested code is never a good idea
I think the point is the bugs are being FOUND with AI. Not fixed with AI.
It’s basically the same concept as open source in general. IE the average layman hears open source and they think “oh so every moron, malicious person etc… can add his own back doors into the code”, of course not, the official version is gated and reviewed. What’s happening is AI is basically serving as millions of idiots looking through the code for security flaws, and it’s finding them. Which then means the humans fixing it need to go into overdrive to fix them before they become zero days.
It was a whole thing back and forth that Linus finally ruled on. It’s supposed to be under the purview of a specific human ultimately but as we’ve seen with countless other projects people get lazy fast with LLMs and testing and review does slip. I trust Linux overall to be better than many other projects yes, but to state AI is not doing development too when it’s very much allowed and discussed is blind to what’s been happening in the project.
No, in this case the AI is finding the bugs and humans are at least reviewing the code and, anecdotally at least, in a lot of cases still writing it in the first place.
You should read the article. Linus simply said that LLMs have been useful for finding more bugs, which has led to larger patches (because each patch contains more fixes). They aren’t vibe coding the kernel.
Ugh. If this makes my Linux systems less stable, I don’t even know what the fuck I’m going to do. I won’t go back to Windows, I’m not buying Macs (which have their own software problems anyway), and my hardware probably won’t work with any BSD variant.
What Linus is saying that LLM review is finding decades old esoteric bugs in the kernel code, like dirtyfrag. And the amount of bugfixes and mitigations are pushing the update sizes up. This is making the kernel more secure and stable in the long run. It will be just a rocky couple of years.
they are NOT vibe coding the kernel.
This comment should have been the post.
deleted by creator
AI is finding bugs, which are getting fixed. That’s great, it means a more secure and stable system. As these vulnerabilities are patched out, they are gone forever(regressions not withstanding).
Theoretically, Linux could become perfectly secure. It’s not going to stop people from doing insecure things, but it could mean there are no unintended security weaknesses. We could hit a point were an “LTS” copy of Linux never receives a single security patch, because as long as the code isn’t changing, there’s nothing to fix.
Of course, this is all theoretical, and assumes that new classes of attacks or bigger chains for attacks are never found, but vulnerabilities should be a finite resource in a static codebase, and once that resource is fully exhausted, the code is now fully safe.
Ideally, open weights or open source models catch up, and this can all be done without paying a ransom to OpenAI or Anthropic, and is available through the whole stack, not just kernel level.
Ironically those are all bug fixes.
The same way Windows is “fixing bugs” with AI? Large volumes of dubiously tested code is never a good idea
Linus’s post only says the bug were found using an AI tool, not fixed using AI.
I think the point is the bugs are being FOUND with AI. Not fixed with AI.
It’s basically the same concept as open source in general. IE the average layman hears open source and they think “oh so every moron, malicious person etc… can add his own back doors into the code”, of course not, the official version is gated and reviewed. What’s happening is AI is basically serving as millions of idiots looking through the code for security flaws, and it’s finding them. Which then means the humans fixing it need to go into overdrive to fix them before they become zero days.
They’re absolutely being fixed with AI too.
https://github.com/torvalds/linux/blob/master/Documentation/process/coding-assistants.rst
It was a whole thing back and forth that Linus finally ruled on. It’s supposed to be under the purview of a specific human ultimately but as we’ve seen with countless other projects people get lazy fast with LLMs and testing and review does slip. I trust Linux overall to be better than many other projects yes, but to state AI is not doing development too when it’s very much allowed and discussed is blind to what’s been happening in the project.
No, in this case the AI is finding the bugs and humans are at least reviewing the code and, anecdotally at least, in a lot of cases still writing it in the first place.
Linus is not a fool
You should read the article. Linus simply said that LLMs have been useful for finding more bugs, which has led to larger patches (because each patch contains more fixes). They aren’t vibe coding the kernel.
You will just have to stay on the lts/stable release
AI Release / 2 downloads