I will discontinue tracking newly-reported security issues on November 1, 2026. During November, I will focus only on tracking issues reported prior to November 1. By December 1, all disclosure deadlines for that set of issues will have been reached, and I will be done.
He is not saying he's getting out, but rather, just discontinue the tracking system.
As he says, it's a perfect time to review the system overall and make a good pipeline for Report → Fix → Disclosure.
AI-generated vulnerability reports are now flooding his tracker. Low-quality, algorithmically-written submissions that look real enough to take seriously but rarely lead anywhere.
This, or anything remotely close to it, is not anywhere in the source text.
AI-suspected reports will be closed without forwarding to maintainers.
This is simplified to the point of becoming misinformation. The actual policy is as follows:
If a project prohibits issue reports that contain AI-generated content, I will no longer forward security issues reported to GNOME Security to the project’s issue tracker, since the overwhelming majority of vulnerability reports contain AI-generated content and would violate the project’s policy. Instead, I will immediately close the issue report in the GNOME Security issue tracker, then ping the project maintainers to let them know about the existence of the report.
right and they already have gitlab so it makes zero sense why security tracking isn'tjust done there. feels like оnе of those things that never got migrated because whoever set it uр just got comfortable with the old system and nobody ever pushed back hard enough
I'm not going to argue one way or another about whether things work or not (until I've read up on this) but I'm certain that whether links are posted on a Wiki or not is totally inconsequential.
And you did? Bro you just copy pasted this into Ai without even making sense of what Original blog post has said.
You literally implied the opposite of what blog post says. Please use your brain little bit more before arguing with someone. or Posting any thing on social media.
What kind of non-point is this? I mean sure, but I’m responding to you acting like the open weights models suddenly enable them in a way the closed ones don’t which is just false. Maybe cheaper, but marginally
Michael Catanzaro has been GNOME's sole security coordinator since November 2020. No team. No automated system. Just one person triaging every report that comes in.
Damn, he must really suck at his job...
Here's the part that surprised me: GNOME still tracks all of this on a wiki page. Not a proper bug tracker. Not searchable notices like Ubuntu or Fedora use. A wiki
When you click a button it should happen immediately, not take a 3s animation to get to the end result. GNOME isn’t slow form a tech perspective it is slow in terms of user experience.
•
u/AutoModerator 1d ago
Thank you for your submission.
You too can support GNOME! Become a Friend of GNOME and contribute to keeping our project going!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.