Post

Seth Larson
@sethmlarson.dev

I've noticed a concerning trend of "slop security reports" being sent to open source projects. Here are thoughts about what platforms, reporters, and maintainers can do to fight back: #oss #opensource #security #vulnerability #vuln #cve #slop #ai #llm sethmlarson.dev/slop-securit...

sethmlarson.devNew era of slop security reports for open sourceI'm on the security report triage team for CPython, pip, urllib3, Requests, and a handful of other open source projects. I'm also in a trusted position such that I get "tagged in" to other open sou...

13 reposts17 likes

Olivier Grisel
@ogrisel.bsky.social

I confirm that the scikit-learn project maintainers received at least one such report a few weeks ago via the Huntr platform. At least the Huntr interface displayed that the reporter was "noisy" so this will probably be blocked at some point (hopefully).

James Bennett
@b-list.org

A really frustrating bit is when someone just spams LLM text back at you and doesn't even bother to run the "proof of concept" their thing generated to see if it works. Got one of those a little while back.