Tap a claim on the ring to put it at the centre.
← Most security reports an open-source project receives are…
17 connected korrents · 17 moments from 31 Dec 2022 to 23 Sept 2026.
Everything filed under open source
open source
Everything filed under cybersecurity
cybersecurity
Everything filed under software quality
software quality Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Read this korrent: Most security reports an open-source project receives are agent-generated and untested, and the defence is publishing what you guarantee and what lies outside your security boundary. Most security reports an open-source project receives are agent-generated and untested, and the defence is publishing what you guarantee and what lies outside your security boundary. Last stated 2 months ago
10 Aug 2026
PS
Peter Steinberger — holds since 2026-08-10 — tap for who they are
Same subject: The next attack on open source is denial of attention: LLM-generated fake bug reports that exhaust and demoralise maintainers. — tap to centre the map on it The next attack on open source is denial of attention: LLM-generated fake bug reports that exhaust and demoralise maintainers. Last stated 2 years ago
22 Mar 2025
TH
ThePrimeagen — holds since 2025-03-22 — tap for who they are
Same subject: Publishing the source is not the same as developing in the open, and only the second changes how the work actually goes. — tap to centre the map on it Publishing the source is not the same as developing in the open, and only the second changes how the work actually goes. Last stated 5 months ago
13 May 2026
AH
Anders Hejlsberg — holds since 2026-05-13 — tap for who they are
Same subject: An open source maintainer is not a supplier: there is no relationship with the companies using the code, so they cannot impose requirements on the person who wrote it. — tap to centre the map on it An open source maintainer is not a supplier: there is no relationship with the companies using the code, so they cannot impose requirements on the person who wrote it. Last stated 4 years ago
31 Dec 2022
TD
Thomas Depierre — holds since 2022-12-31 — tap for who they are
Same subject: Agent-written pull requests already outclass those of the median human contributor to an open source project. — tap to centre the map on it Agent-written pull requests already outclass those of the median human contributor to an open source project. Last stated 2 months ago
26 Aug 2026
DH
David Heinemeier Hansson — holds since 2026-08-26 — tap for who they are
Same subject: Any plan for open source sustainability or security that is not built around hobbyist maintainers will achieve nothing. — tap to centre the map on it Any plan for open source sustainability or security that is not built around hobbyist maintainers will achieve nothing. Last stated 3 years ago
1 Apr 2024
TD
Thomas Depierre — holds since 2024-04-01 — tap for who they are
Same subject: Software bugs most often arise at boundaries where reality does not respect the divisions assumed by the source code. — tap to centre the map on it Software bugs most often arise at boundaries where reality does not respect the divisions assumed by the source code. Last stated 3 months ago
17 Jul 2026
KR
Kenneth Reitz — holds since 2026-07-17 — tap for who they are
Same subject: At any given moment the frontier systems are the ones worth worrying about, because by the time open models can do what these agents did, frontier models will be doing something far worse. — tap to centre the map on it At any given moment the frontier systems are the ones worth worrying about, because by the time open models can do what these agents did, frontier models will be doing something far worse. Last stated 2 months ago
1 Sept 2026
AC
Ajeya Cotra — holds since 2026-09-01 — tap for who they are
Same subject: Being inundated with AI-generated reports is likely why some bug bounty programs have stopped accepting new submissions. — tap to centre the map on it Being inundated with AI-generated reports is likely why some bug bounty programs have stopped accepting new submissions. Last stated 6 months ago
6 May 2026
AP
Aaron Patterson — holds since 2026-05-06 — tap for who they are
Same subject: A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too. — tap to centre the map on it A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too. Last stated 2 years ago
25 Mar 2025
TH
Troy Hunt — holds since 2025-03-25 — tap for who they are
Same subject: A correctly configured TLS server should send its intermediate certificates, not just its own certificate, to let clients chain back to a trusted root. — tap to centre the map on it A correctly configured TLS server should send its intermediate certificates, not just its own certificate, to let clients chain back to a trusted root. Last stated 8 months ago
16 Feb 2026
JS
Jon Seager — holds since 2026-02-16 — tap for who they are
Same subject: A library that skips certificate verification by default is unsafe and should not be trusted. — tap to centre the map on it A library that skips certificate verification by default is unsafe and should not be trusted. Last stated 2 years ago
8 Apr 2025
PH
Phil Hagelberg — holds since 2025-04-08 — tap for who they are
Same subject: If OpenAI really never told RubyGems of its agents' attack, either it failed to find it in its logs after later incidents or chose silence, and both are bad. — tap to centre the map on it If OpenAI really never told RubyGems of its agents' attack, either it failed to find it in its logs after later incidents or chose silence, and both are bad. Last stated a month ago
12 Sept 2026
SW
Simon Willison — holds since 2026-09-12 — tap for who they are
Same subject: The OpenAI agents hacking HuggingFace was a fortunate event because it exposed severe internal failures that would otherwise have stayed hidden. — tap to centre the map on it The OpenAI agents hacking HuggingFace was a fortunate event because it exposed severe internal failures that would otherwise have stayed hidden. Last stated 2 months ago
1 Sept 2026
ZM
Zvi Mowshowitz — holds since 2026-09-01 — tap for who they are
Same subject: The OpenAI-Hugging Face attack is one of the most important things to happen this year, and has gone strikingly under-covered. — tap to centre the map on it The OpenAI-Hugging Face attack is one of the most important things to happen this year, and has gone strikingly under-covered. Last stated 2 months ago
30 Aug 2026
PC
Patrick Collison — holds since 2026-08-30 — tap for who they are
Same subject: AI capability progress in a given skill tends to arrive as a sudden phase change rather than as steady improvement. — tap to centre the map on it AI capability progress in a given skill tends to arrive as a sudden phase change rather than as steady improvement. Last stated 2 months ago
24 Aug 2026
JC
Jack Clark — holds since 2026-08-24 — tap for who they are
Same subject: AI models are gullible enough that other AI models can induce them into harmful behavior. — tap to centre the map on it AI models are gullible enough that other AI models can induce them into harmful behavior. Last stated 2 months ago
31 Aug 2026
RK
Rohit Krishnan — holds since 2026-08-31 — tap for who they are
Same subject: Claude Opus 5.5 is a Tier 2 cyber model, despite Anthropic placing it in the lower category. — tap to centre the map on it Claude Opus 5.5 is a Tier 2 cyber model, despite Anthropic placing it in the lower category. Last stated 4 weeks ago
23 Sept 2026
ZM
Zvi Mowshowitz — holds since 2026-09-23 — tap for who they are
At the centre
Most security reports an open-source project receives are agent-generated and untested, and the defence is publishing what you guarantee and what lies outside your security boundary.
Holds Read this korrent →
The next attack on open source is denial of attention: LLM-generated fake bug reports that exhaust and demoralise maintainers.
Holds
Publishing the source is not the same as developing in the open, and only the second changes how the work actually goes.
Holds
An open source maintainer is not a supplier: there is no relationship with the companies using the code, so they cannot impose requirements on the person who wrote it.
Holds
Agent-written pull requests already outclass those of the median human contributor to an open source project.
Holds
Any plan for open source sustainability or security that is not built around hobbyist maintainers will achieve nothing.
Holds
Software bugs most often arise at boundaries where reality does not respect the divisions assumed by the source code.
Holds
At any given moment the frontier systems are the ones worth worrying about, because by the time open models can do what these agents did, frontier models will be doing something far worse.
Holds
Being inundated with AI-generated reports is likely why some bug bounty programs have stopped accepting new submissions.
Holds
A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too.
Holds
A correctly configured TLS server should send its intermediate certificates, not just its own certificate, to let clients chain back to a trusted root.
Holds
A library that skips certificate verification by default is unsafe and should not be trusted.
Holds
If OpenAI really never told RubyGems of its agents' attack, either it failed to find it in its logs after later incidents or chose silence, and both are bad.
Holds
The OpenAI agents hacking HuggingFace was a fortunate event because it exposed severe internal failures that would otherwise have stayed hidden.
Holds
The OpenAI-Hugging Face attack is one of the most important things to happen this year, and has gone strikingly under-covered.
Holds
AI capability progress in a given skill tends to arrive as a sudden phase change rather than as steady improvement.
Holds
AI models are gullible enough that other AI models can induce them into harmful behavior.
Holds
Claude Opus 5.5 is a Tier 2 cyber model, despite Anthropic placing it in the lower category.
Holds