Hi, now I intend to start the time is up.
I have a little talk to you.
It's this and then we can go home.
You look a little tired.
It feels like I've talked to almost all of you already.
It's for us, Dan.
But if it's a repetition, I apologize.
But this is me.
I am Daniel.
I am the president of the European Apostles Academy.
I actually have a new medal in my bag.
Yeah, so that must be my student.
That's my size.
So I work on a tool.
Some of you have seen it.
It's really the thing.
It's rather new.
Anyway, I'll get back to that later.
But anyway, that's probably the course curl.
And most of you know all of this already.
I started this a long time ago.
I've been working on it a lot.
So it has taught me and most of you,
I mean, many of you at least have followed my struggles with this.
So AI nowadays has really,
It's really a tool that augments us humans,
right in many cases.
And humans can go either way, right?
You can go into the left or to the right up or down.
And it certainly helps AI.
It certainly helps us to go either way.
The bad way or the good way.
You decide which way, right?
So yeah, that's the way it works.
So we can seriously get a lot of AI.
Slop because people don't even try to find out.
If it's too not, you just pass it on.
No breaks at all.
Or you can use the AI to find some awesome tools.
We'll never could find before.
You can use AI by reports.
Generated with an AI tool to actually help projects.
Because you can find things you never could before.
Or you can use those tools to just overload a project.
Because you can do that now.
Even if they legitimate, if you happen to be a really big tech company.
And that's the little small open source project.
Yeah, that's overloading.
You know who I talk about.
And of course, you can use all these new powerful tools.
I mean, I don't mean I'll get back into some details.
You can use all of these new tools to find fun flaws never found before.
And you can use them in really malicious ways.
And nefarious and attack.
And find new flaws and be your bad person.
Or you can use the AI tools to review your code.
Make sure your code actually gets a lot better before you merge your PRs.
There are a lot of ways to improve the world with AI.
Or you can just overload every open source site in the world with your AI scraper bots.
So we can suddenly get a lot of bad scrap.
We can get good crap.
But anyway.
Yeah, all right.
And then we have these skills.
You can use AI in the analyzer and this means valid bug reports,
which has also happened a few times already.
So there's a lot of AI.
A lot of bad AI.
Some good AI.
So yeah.
But everything has AI.
And you know, one advantage we're doing to talk about AI is so much easier to pronounce than
HTTP 3 in the talks.
I've been here before.
I've selected better words this time.
So I'm going to say AI like a bazillion times this talk.
So but I just wanted to sort.
AI is a sensitive subject to many people.
And AI is a questionable technology.
And just by using the word AI, I know I upset sort of half the audience.
But no, it's not AI every time.
It's not an LLM and it could be machine learning.
And in my talk, I don't care.
I'm using sort of the marketing language.
It's all AI.
And usually when people say something at me, they say they use AI to do it.
Or they didn't say AI.
But I don't know which technology, right?
I don't know if it was an LLM or machine learning.
They say AI, I use the phrase AI.
So they use a lot of energy.
We have the license, the rate, right?
They free load on a lot of open source.
They spy that the web to the death, right?
We are overloaded.
I'll talk more about that.
They take all the money right now because now no one can do anything that is not AI
because no one will pay you anything at all.
And you know, yes, try to buy your computer with memory now.
And no one is paying anything for this, right?
How is that possible?
It's free forever.
And again, AI is a vague term.
Sure.
There are a lot of different technologies underneath.
But I'm going to talk about the term as AI.
Anyway, because, yeah, that's me.
Okay.
And everyone who thinks this is a good technology will tell us all,
sure it'll be better.
And maybe it will, right?
But yeah, I'm allowed to complain.
And by the way, this is my talk number 16 at first.
Okay.
So back to Carl, I started it a long time ago.
We're celebrating 30 years in November.
Thank you.
So yeah, that means we went from 100 lines to 180,000 lines.
In just 30 years, imagine 160.
And yeah, we're 1,400 authors.
I work on this whole time.
20, 25 authors per month, 3500 people, or have a name in the thanks file.
Yeah, you know, an ordinary open source project.
We run in a few things.
I mean, this screen is really horrible.
It doesn't show, but you get the point.
Yes.
We estimate somewhere around 20, 30 billion installations.
But basically, everywhere, it makes, at least,
sort of, in our project, we take then security seriously, right?
There.
It could possibly make the bad impact if we have a terrible security thing somewhere.
And at the same time, we have AI, right?
So it's finally, we can make it come true.
I want my favorite old quotes.
Well, I don't know why.
But people think about curl as something that is easy to do.
So anyway, this is my hobby.
And just going back, and all of those products are showed.
The curl runs in that.
And I mean, curl is not unique in that everything runs on open source.
So I think the entire world actually runs on open source.
It has been mentioned many times at first time, and we all know that right now.
So the world has turned into this.
Everything runs something.
Most of it is now open source.
And you put something on top of it, which isn't.
And I couldn't talk about this without XKCD.
So yeah, this is just how the word works.
And when everything runs your code, I'm sure that I'm sharing this with a lot of you.
But when you have a lot of users, you're a little bit sensitive.
That's a security problem.
Someone tells that something really bad can happen if this condition is true.
And so it tends to take the top priority, right?
Security problems, number one.
So at the same time, maintaining open source as we all know, right?
It's where the average or the median number of maintainers in a regular open source project is one, right?
We're all solo maintainers of at least one project.
Probably seven or 13 in this crowd.
Yes.
Most of them, or many, are a spare time project.
Hobby thing.
We do at this side, or partially paid or whatever.
Underfunded is sort of the middle name of every open source project.
We have a lot of outstanding tasks.
Always because what's not the to-do list, right?
Always a lot of things we should do if we have the time and inspiration.
Or someone submits a PR or something.
With a lot of us struggling with a burnout, what do we do with that constant to do list?
Lots of things to do, people submit issues, wine, whatever.
Yeah.
There are normal open source projects.
And then AI.
Yeah.
So AI can potentially don't help us.
Yes.
So we add AI to everything.
Yes.
Okay.
It's super easy to ask your LLM to find a problem.
And I haven't tried this really myself, but I imagine that some projects are easier to find problems in the others.
I mean, find problems.
But possibly if the machines have trained a lot on your code, maybe they find more or less.
I don't know.
And there's really, and since we're not paying for this, there's really no cost to try this.
And effortless.
Just ask it.
It answered something for you.
Ask it to provide really long answer.
And it'll do that.
Make it.
Ask it to make it sound really horrible.
And it'll do that.
And then you just send that report away.
But you know, can it actually find problems?
Who knows?
In a lot of cases, it seems to be that this is a marketing machine that has to really solve this myth to a large part of the world.
And to a lot of engineers, right?
It seems that a lot of people genuinely think that if you ask chatchipit for a security problem, it will tell you one.
And we better report it.
So yeah, it works like that before in the old days, you know, someone actually invent invested a lot of time.
Effort.
It took hours to dig up some details about the security report.
It was a built-in friction here.
There was a break.
Someone had to do something a lot.
It was a contract, right?
You spend a lot of time.
You report it.
We spend time on assessing it in our end.
But now there's no effort at all in doing this.
The sort of the floodgates are open.
Send it over.
And of course, it doesn't work.
And for some reason, we're more targeted by this development than a lot of others.
But based on the fact that this is so easy to do.
But anything in the world that is sort of.
We have removed the part where there is sort of you have to invest some work to make it happen.
Everything that is like this in the world is broken now when you can get to AI to do it.
Even though they can't do it.
But apparently people don't really check that.
So how do you, how does this appear?
People then constantly ask me, how do you know it's an AI?
And yeah, how do you know it's an AI?
Yeah, no human ever started like I apologize.
But I found a problem.
No way.
I mean, we all know that.
We've been working with open source for a long time.
People tend to be a little bit more on the other side, right?
They're upset, they're angry, how stupid can I be that I made this bug?
Okay, yeah, they're all perfect English.
And for sure, I mean, we're all, I'm not an native English speaker.
I do lots of mistakes and sure I can use spelling checks and everything.
But normal humans actually have quite a lot of errors.
And I mean, that's what makes a human.
That's fine.
But the machines never do that.
And I don't know why, but they like this mixed case.
So that's the, you know, if this submission starts title,
and then there's spelled out the bug all mixed case.
You know, that's weird.
That's not, that's not a human writing that.
And of course, I mean, that's a constant thing.
I'm that she's not.
And when I say I'm that she's done three people in the audience
who will tell me that they all use them that she's in their notebooks.
But, you know, this combination here, it never were perfect is.
And for some reason, I don't know, I don't, it's weird.
But we're told that they're trained on a lot of source code right.
But really, emojis in every source code example.
I must be really old, I think so.
I don't, I don't ever use that.
But what's like to do that?
And actually one of the problems.
And I don't really know why.
I'm, I guess they asked for this.
But the reports tend to get really, really, really, really long.
Which is maybe, I mean, back in the day,
we try to get serious real bug reporters.
Can you please tell me a little bit more, right?
It doesn't work.
No, but tell me more, right?
Now, now, now we're in the other camp.
Tell me less, sort of, please.
So, one of the things I've started recently is like,
there's a long report.
I don't read it because it's too long.
I sort of, this is probably, I ask you for the web question.
And then I ask you sort of, okay, can you please explain this
in 10 lines or less?
Because if I don't, I will get another 200 lines
in a follow-up report, right?
You're absolutely right.
blah blah blah.
And yes, every paragraph needs three bullet points in the list.
And of course, again, a human might do that,
but not like 12 paragraphs with three bullet points.
It's three bullet points in each.
I mean, that's super crazy.
And then, as I said, if, if you don't qualify in a thing,
you get a long report and you ask a follow-up question,
what happens?
You're absolutely right.
I'm sorry.
I'm, my mistake.
You've misunderstood.
And blah blah blah blah blah.
And that's how it works.
And the funny thing is that it easily loses track
and goes in some other direction than it started.
I mean, humans also do that, but yeah.
So we'll end up with a copy, or the proxy,
me and the bot chatting, sort of downhill.
Yeah, that never ends well.
It's okay.
Let me give you one of our favorite examples.
It's going, oh, no, I think it may 2025.
So yeah, a little over soon a year ago.
I mean, okay.
So this, okay, curl is slightly technical project.
You know, we speak internet things, internet things
can be complicated.
Where HP3 is a complicated protocol.
All of these complicated things.
Okay.
HP3 stream dependency cycle exploit.
And, you know, they're always critical.
This critical.
The world is burning.
Everyone is going to die.
So stream dependency cycle exploit.
You know, no, the export blah, blah, blah.
Some serious, right?
Zero x zero zero over view.
I don't know what that is.
Okay.
Tested on version 813.
I think that was the current one at the time.
Maybe.
Yeah.
There's a proof of concept required amount of environment setup,
attack execution.
Yeah, you just need to apply.
I mean, you need to apply this little patch on your,
this is a existing HP3 server written in Python version.
This looks legitimate.
You just need to apply this little patch to reproduce the bug.
Perfect.
Cool.
This guy is done something.
And then this, well, so yeah, this is then you need this exploit code
to run proof of concept.
Cool.
Okay, reproducible.
And when you do that, this is proof of what happens.
You run curl with that command line.
And you set a break point and just function and you run.
It's the exact segmentation fault.
That's not good, right?
Sigma.
Bad.
Wait a minute.
What is that?
So it looks.
I mean, from, it's like a TV show.
Anyone who's actually never seen the code,
it looks totally credible because anyone on the outs,
I have no idea if this is real or not.
And the person who did it, certainly have no idea if this is real
or not.
But by the time, you know, this is down to 500 lines,
down in the report.
And, you know, wait a minute.
That function actually is strong.
Okay.
Better read the rest.
Okay.
Here you can see his using GDB, analyzing the crash.
You know, this is your tear.
So, okay.
Look in the registers, the frame data are 15 shows.
Yeah, 41, 41 for one.
You know that ask a code.
AA, AA.
It looks bad.
Memory, corruption, evidence, blah, blah, blah, blah.
And that energy to be in command line again.
Yep.
And bullet points.
Risk.
Aye.
He placed out corruption.
And, you know, we everything in courley's written in C, right.
Memory, language, also so.
Memory, memory safety is sort of a weak point.
We'd see.
So, potentially this could be really bad.
But.
So, this report came back in May and I think I was a little bit
inexpressible youtuber.
in experience back then.
So I actually wasted far too much time
before I actually started looking at the detail in this report.
But basically, he said a break point on the function
and ran, but the function doesn't exist.
Wait a minute.
How did he set the break point?
So the entire GDP session is made up.
The contents of those registers, it actually
can't be that way, because it has the wrong content.
This never happened.
It's just generated fake GDP session.
Yeah, they're all made up.
Enough thing of this happened, and it's all right.
Nothing was real, and the entire description
is just totally made up.
The bad TV show.
So no.
And I think back in the spring of last year,
I still actually spend some time to try to figure that out.
Before I learned this, that it should actually
never spend the time, I should just ask the person
in a lot of questions before I do that.
So yeah, I tend to call this terror reporting now.
So that's the feeling we're having the team.
So yes, a total waste of time and energy
in the Carl Project, where seven persons in the Carl
security team, and we receive these.
And over the years, every time we have received
the security report, that's a bad feeling in your stomach.
Wow, now it's something bad happened, potentially.
We used to have one in six reports, we're genuine, one in six.
Yeah, that's still pretty often.
We got two, three per week, maybe.
So when you wake up in the morning,
and you see one of these, you have a incoming mail
from the security backbound to report.
It's felt a little bit bad.
But over 2025, through the end, and into 2026,
now the rate has gone.
So now it's more like one in 20, or one in 30, that is accurate.
Which means, you know, we spend a busload of time
just to figure out that it's just not accurate in the end.
So it doesn't really work.
And we spend a lot of time on this.
But what is interesting, and I actually
have no good explanation for this other than I think
that a lot of people have now also started to use the AI
to get the report, but they don't write the report with the AI.
Because the new generation of stupidity
doesn't trigger all those warnings with AI.
So we get a lot of just stupid things.
I don't know how often we get someone telling me
that the Git repository is, you can see it on the website.
Thank you.
Critical.
And some other things, when you can then go into that Git repository
and show me that you can actually see a source
fight from the Git repository on the website.
Yes.
Or why do they report this to me?
I honestly think that this is something the AI has been
trained on that is really bad, because you can access
local files with file colon slash.
Yes, that's sort of what it means.
But we get it over and over and over.
And of course, this regular old thing we've always had.
People want to tool something and they send it,
but it's more good old stupidity.
But anyway, of course, it leads to that I think,
for some reason, in the beginning of January, 2026,
something happened.
I guess people had more time over the holidays or something,
but I think I received seven security reports.
First Monday, I've got to work.
I spent the entire day reading and arguing
with reporters about their stuff.
Obviously, when we get a lot of this stuff,
we do little else.
So of course, it starts out what else we can do in the project.
And I can guarantee you, we have other things that we
rather do.
So of course, this overload of stupidity makes us less
other things, and then risk that we just overdo something,
or we just get so bored that we close them all and just go home.
And it's certainly impact our mental health,
or just will to live because it's such a stupidity.
And of course, in the end, seriously,
it could potentially impact the supply chain,
because if we are used in all these places,
and we are getting slow, just because we get bored and overloaded
and tired because of all of this, it'll lead to something bad, right?
Potentially.
But why?
So our theory, we hope that a lot of people are doing this
for the money.
We have a bug bounty.
You could potentially, or rather, we say that if they actually
get a critical report confirmed, we offer them $10,000.
So that's the sort of the pipe dream.
I guess that's why everything is critical.
For the early low report, with severity low,
we give them $500.
So that's the price span, or the award span they're looking for.
But really, a lot of them, when I abandon them,
because I do, right?
When I, they get very upset, right?
Because here I am reporting a bargain.
What will you do is banning me and sort of being rude to me
when I try to help in out in your project?
So clearly, of course, they might be lying,
but given the trend, I genuinely think that a lot of them,
actually, did this with some amount of actually believing
that they were helping out.
And that makes me just sad, right?
So yeah, I have a lot of discussions.
And of course, I could just mention it.
Of course, ridiculeing people in the public.
That's not recommended way to do it either,
because, of course, in some cases, they actually
were genuinely trying to help out.
But what do we do?
Yes.
So how often doesn't happen?
It's really hard.
And back again, to talking about AI and saying, AI
will the time, the AI is, of course, also
change over time, right?
As we know, a lot of things are happening with AI
all the time.
So the look of the AI generated stuff from a year ago
has changed.
So the AI generated reports don't look exactly the same anymore.
That means also that it's harder sometimes
to detect what is an AI output or not.
I mentioned a lot of typical things,
but people also tend to skew there, because they know
that if they say, is AI, I will ban them and fill that them.
So they, of course, they lie and say, do you
say, I know, no, no, I apologize.
You're absolutely right.
But yeah, so that's also why I think some of them
are just rewritten to not sound like AI.
But there's somewhere around 30 to 70% of the submissions
we got up to, at some point, late of 2025, early 2026.
At least until I started saying that I would stop
the bug bounty, just saying it, put a break on it.
But again, exactly it is really hard,
because it's not an exact science.
And right, two years ago, nothing.
So this is certainly a new trend.
And this is not a new trend that is happening just to me
or to us, right?
We can see that in a lot, especially when I started talking more
loudly about it, I've heard from a lot of projects
having maybe not the same rates, and the exact rate,
doesn't really matter, but the same problem,
and the same problem in a little bit of different ways
and looks, but certainly happens to a lot of us.
So what do we do?
We try this, right?
But ban the reporter instantly.
That's good.
But if you use a platform when the user can instantly create
a new account tomorrow, the banning is really, really
useless.
They don't really care.
And we try this, pretty early on in 2025,
I added a little section in the submission form that you should
tell us upfront if you use an AI to do this.
Which worked, I think, for three, four reports.
But then since then, no one has used AI.
Hi.
Yeah.
Then they worked at all.
But back again to us being an open source.
Of course, we want to be open source.
We want to be available accessible and transparent,
like everyone else who's doing open source.
We don't want to raise the bars and add walls
and everything to make it really complicated.
Also, we want to make sure that currently
security is safe and everything.
So we want genuine, really reports submitted.
So we can fix it for everyone and make everything better.
But that's a tricky combination and challenge.
So I started it partly because some of them
were so stupid, so it becomes pure whom humor sometimes.
After they settled down and take the breath
and sort of take a good night's sleep and come back.
And then you'd realize that sometimes just pure humor,
so I had to share quite a lot of them online.
And then I started making a list with all of them
that I could easily detect.
And I think public shaming worked to some degree,
because I talked to some of the genuine security reporters
that they actually reconsidered and double checked before they
reported.
But unfortunately, that only puts a little break
to the real sensible, wise people.
And they were already good ones, right?
So this doesn't really help either.
So back to doing good or bad with AI.
This is a really about AI.
Everyone, then when I say something about this,
half of everyone I talked to, they say,
you should use AI to combat AI.
But that's not the problem.
The problem is not the AI here.
The problem is the human in between,
because it's the human that submitted to this to us.
So it doesn't really matter AI or not.
It's the human here.
And humans, no, I can't fix the humans, not even with AI.
The AI makes this really easy.
Marketing says this works.
They're going to continue to do this.
As long as it's very easy, low effort passes it on.
It's a human-created thing.
And as long as the humans can do this easily,
they will continue to do that.
AI or not.
So we close the down, starting actually officially today.
APPLAUSE
I mean, we hope we wish we think that this will put an end
to sort of, at least, they can't go for the money,
because now there's no money.
But we'll see if that actually turns out to be true.
I will come back with that.
But at the same time, I want to emphasize,
because I show you, and I'll give you,
given URL, later, that you can use to exercise yourself
in these superitatives.
But at the same time, this is a tool.
AI is a tool.
If you want to do that, and ask it to find a security problem
with a tool, and you never verify you get really stupid things.
But if you use it for, I mean, if you're a clever person,
and you use a good tool, you can do really good stuff.
So we work with several AI powered analyzing tools now.
Even though AI can be used to do really bad stuff,
that you can use it to do really good stuff.
And it's actually so.
I mean, if you're doing writing in kind of code,
like me, I'm old, I'm working with C, old stuff,
we throw everything at the code, right?
We have the most picky compiler options enabled.
We run code analyzers.
A lot of them.
We do fuzzing.
We do have security or it's multiple times.
We fix everything.
Every picky morning, we have a few users who report bugs.
When they find bugs, you would imagine
that we would have a pretty good state.
You know, fix most bugs.
It shouldn't be terrible.
Running one of these more powerful tools,
I have fixed more than 100 bugs
found by these tools, so I started to use them.
And I mean, back again, yeah, that's AI.
That was so bad on the in one way.
Still is bad in one way, or some in the other way.
So yeah, there's certainly a lot of things.
No other tools previously found.
And in ways, no other tools previously could find.
And yes, that means that if you want to find something
to exploit in something somewhere, the bad guy
is, of course, also run these tools and find things
and bugs to exploit security problems in existing tools.
So it certainly up the games here quite significantly,
because these tools find things in what sometimes
feels like magic of ways.
Yeah, but again, you need a clever human involved here.
You need probably somewhat experienced
engineer to actually figure out, even though you
have a capable tool that finds a lot of things,
or the things real, or the important, or the valid,
part of the fed, sort of a tax surface or not.
Yeah, so we have fixed a lot of things.
For example, one of our bigger fancy things with these tools
is that no other code analyzer can do.
They're really human-like behavior.
When the AI is back again, you know that curl talks a lot
of networks, like 29 or so, and the underlying protocols.
A lot of stuff, right?
So when you look at a code and the code does something,
is it right or wrong?
It's really hard, and you have to know a lot
about internals and curl protocols networking, blah, blah.
It's hard to review that as a human.
And then when you have a tool that can say,
hey, this code uses octet 252 here, but the telnet
spes says that is invalid.
Wait a minute, that's almost magic.
How does it know what the telnet spes says?
No one has read that since 2012.
And it's a fascinating helper, right?
And I mean, telnet spes might be a niche thing,
but it can also sort of relate to other things.
Or one of my favorite things is when I update a code,
or I have code and the comment above the code,
they disagree, which is right.
That might sound like a subtle thing,
but it's an awesome thing because the rest of my code, right?
The rest of when you make a function, even if it's internal,
you have if you're having things in the best possible way.
You have this heavily little documentation for your function
that may be above, and if that's the documentation is wrong,
the users of that function in your code is possible wrong.
And it's perfect for finding, for getting an edge case,
or for getting you used to use this in 28 other places
in your code, but you don't do it here, why?
Like, yeah, a human can find that and find the humans do.
But it's boring, and people are really bad at code review.
We all know that, right?
But the machines, they don't go tired.
And my favorite thing is, what do you do?
That's two in the morning, the bots are there.
Yeah, one of my favorite thing is when it tells me,
when I forgot to do test case for my new code.
And also, it's really good, for example, analyzing other libraries.
So you do do function calls from your code
into third-party library, and it can tell me
about assumptions I do on the date I'd returns,
which also is nothing a normal code analyzer can do,
because a normal code analyzer only analyzes your code,
not the other code, or the interaction between them.
So really fascinating tools.
So it really opens up a new way to improve code
and make things stable and better.
So you can really do a lot of good things.
Yeah.
And nowadays, I'm talking a lot with a code review.
And a for code review is really good, too,
because all of these, especially back, I should also
practice with, I mean, we're not paying the cost still.
So we're getting a lot of good stuff here without paying for it.
And that's good.
I mean, at some point, we're going to have to start to pay for it.
And then it's going to be a different tune.
But anyway, right, when I do my PR2 in the morning,
usually my other colleagues are not around,
but my review bot is.
And they find things really fast,
and they find things humans tend to miss.
They really make my pull request better.
I would probably have found those bugs later anyway,
but sure, it makes things better.
Funny thing is that the different tools, as I said,
we use three different AI review bots.
They find different things, all of them,
even though you would imagine that there are basically
trained provided by the same AI
to join in the bottom anyway.
It's just fascinating.
It's also fascinating.
Just to show that they are certainly not perfect.
And there's certainly not a compliment to test cases,
because it's kind of fun to ask the AI for a review,
and then run the test cases, and see if they
review or actually found the problems,
the test cases can find.
But they really do that.
Yeah.
So it's a cheap, especially for us,
because I'm fortunate to have a project people see.
So they throw these at me to test it for them.
Where there's a luxury, of course.
But test cases is still way more important, of course,
as always.
AI, using an AI to write code, I don't use that.
I'm not impressed.
I don't like it.
I don't use it.
I don't think anyone actually in the code project do.
So I hear that's a fun thing to do.
I've never been impressed.
And all of these tools are really good.
For example, all of these AI detection tools
that can find problems in your code.
All of them offer, like, a generate to patch to fix this,
but they're never good.
So fixing code is still, I think, way better to do as a human.
Proper human fixes code, way better than the AI is to.
But of course, having an eager junior
providing good suggestions, maybe that is good.
You get a lot of suggestions from the AI, at least.
And some of them, parts of them are good, right?
And then you can cherry-pick the good parts and forget the rest.
So we don't use it.
Officially, I don't know if someone who provides a PR tomorrow,
I don't know if they used AI or not.
The good thing about having a good test coverage,
or lots of test cases, is that if someone would just
throw a bad PR generated, sloppy with AI,
it would all just turn red in the CI,
and I wouldn't care about it.
If they wouldn't fix them, I would just close it and move on.
So it's not a waste.
I think the primary thing that our security program, for example,
is that we keep security reports secrets, right?
It's a closed group, limit in amount of people that
have to care about it.
When it comes to issues and pull requests,
they are done in the open.
They're potentially everyone who has could help out
and close them or ask for what questions and everything.
So less of a problem, at least for us.
And of course, what I mentioned already there,
I cannot mention this without a course
talking about the AI scraper, overloaded a bit more.
In the curl project, I'm fortunate to be sponsored
by one of these CDN giants.
So they easily swallow 75 terabytes per month,
which is just a ridiculous amount of traffic,
and you would have any added down with curl all the time.
No, they don't.
There's less than 0.01% of the traffic.
So what are they doing?
I don't know.
Look, again, the luxury of being sponsored
and they eat all the traffic, and I don't have any logs.
I don't have any tracking.
I don't know what they do.
I can just see, where I'm in this bandwidth span.
It's super crazy.
And of course, I mean, I mean,
then in this fortunate market position,
when I can say I get this sponsored by someone who takes this cost,
I understand that certainly not the entire world,
it is in that position.
So this certainly causes a lot of problems
for a lot of projects, not only money,
but just overloading and handling that
when you're right, you're servers and everything.
So of course, AIs will improve.
Everything will be better or some way
for some use cases.
But I mean, if you're just stupid,
they ask for a security problem from these bots,
I don't see how that's going to improve,
because they live to satisfy you.
They will say, yes, yes, here it is.
That will continue.
Because I mean, that's how they work, right?
They're great.
And humans certainly will not improve.
And so I mean,
we've always had a fair amount of users
being the annoying users, right?
The sort of more or less abusive users,
it's always a certain percent of our user base.
All the time, it's just that now that percentage of users
have the ability to produce a lot of junk for you
in ways they didn't before.
Yeah, so I will continue to augment everything we do
in different directions.
Certainly a lot of bad ways, but potentially,
and obviously also in a lot of good ways,
it all depends on what you do with it.
So at least until we start paying for what it actually costs,
and then we'll see what happens.
I don't know.
But anyway, I've made a little list for some afternoon literature
for you on that, that's a redirect.
It takes you to a gist with, I think, 49 fun reports.
There's less fun and more fun.
But there are all stupid AI generated things.
Thank you.
I think we have time for some questions.
We might even have microphones.
Yes, so we will have some questions.
We will just need to figure out the logistics and their mic coming and there's a question
there.
Hello.
Thank you for your presentation.
Another short question, are you at all concerned about the legal ramifications of people
contributing a I generated code in the future?
Because right now there's not really any legal precedent if that's even legal, right?
So that's my question.
So when people are using, well, from my point of view, we've always had that, I don't
I mean, when someone provides code to you, someone made that code, copied that code,
copied it from Stack Overflow five years ago.
I don't know where that code came from.
So am I worried that the license for this now would be different than before?
I think the risk is roughly the same, sure it might have been copied.
In the current project, we say that whenever we accept a contribution from someone who
provides code to us, we say that we assume that you have the right to do so.
That might not suffice.
I don't know.
I don't think we have many other ways to handle it than that way.
So I think we're going, unless something made your changes, I think we're going to just continue
to have that policy and see where it takes us.
There's another one.
Sorry, hi.
So we've never had a bug bounty, but in the last four months, we've seen a 600% increase in these
wonderful security reports and it vise on how to help in that situation.
Since we can't turn off the bug bounty since we've never had one.
There are many different ways to handle the flood, right?
In our case, we hope to shut up, turn down disabled money incentive.
But I mean, there are many other ways.
Everyone keeps saying that I should charge for the right to submit a security report.
That's one way, or you can have a secret club that you only allow vetted users into
and allow them to submit the reports.
I know one of the other projects I shouldn't name, but the sort of race, the sort of requirements
on users on hacker one before so they have to prove themselves to have a signal that is higher
before they are allowed to submit a security report.
All of those are different ways, basically, to make the newbies not submit the security reports.
Unfortunately, almost every way we can think of the sort of limit the flood in flux means
that we make it harder to submit the reports.
All of that is unfortunate, but at the same time I don't know, I think we need to experiment
and see what works or not.
I think that's why it's also awesome that lots of projects go different ways because
then we can possibly learn from the others, so what works, what doesn't work, and we can go forward.
I mean, emails spam is similar in this, and we have a solution for that.
It doesn't work, but we have at least tried it, and we have something, so I think it's
similar to that.
We just need to figure out ways how to break the inflat somehow.
There's no more.
Hey Daniel, thank you, Europe's absolutely right.
Thank you.
On the health of Microsoft, I'm wondering, when the AI's feature is coming to curl?
I didn't even, I didn't, you know, the sound is this room is weird, because you hear
you and me much better than I hear you.
I've done it many times, I actually have a real question.
I'm looking back at the history of FFNP, Google and Spotify, and I'm wondering, if it's
breaking point for open source investment problem, so the problem of raising funds for investing
those vulnerabilities, I didn't think about raising funds.
Have you heard a story about FFNP, right?
When they had a huge AI's slope of vulnerabilities found by Google, and they denied to do any
contributions inside of, in the direction of Google.
Hey, I tried to mention that without mentioning the names.
Yes, FFNP, again, Google.
The question is, isn't it a breaking point when we have to start talking more about
funding open source software?
The problem there was that, yeah, there's a giant company having a huge department of
security specialist finding genuine problems in code, sending all those reports to poorly
open source project with volunteer maintainers, getting a lot of, in this case, not
sloppy, because they were actually valid, I think, several of them at least.
Yes, and then demanding them to fix them within the next number of days, otherwise we will
disclose them to the public, and you will feel bad.
Is that bad?
Yes.
What do we do about it?
We tell them to stop.
I mean, really, or in this case, I think they write fully told Google, well, you should
submit the fixes as well, because you have the manpower, and why don't you do that?
And then they...
Yes.
And the rest of that follow-up answer you will get when the video is off.
There are some more.
Given the problems with AI that you put on the slides, for example, the energy use and
such, is it ethically acceptable to use AI even just for code reviews?
Possibly possible to use AI for a lot of things.
I don't think using AI is a medicine for this problem either way, because, again, people
are sort of doing this in ways that the AI won't detect anyway.
I think it's a complicated issue, because then people tend to come and say, well, why don't
I require that we can reproduce every bug before we even listen to them?
But then, to me, that's sort of a cute suggestion, because curl runs in a 112 operating
systems, 29 CPU architectures.
It's ridiculous to me, if someone actually finds a problem on a source code in curl, if
you find it, you say, hey, that's obviously wrong, because that happens, right?
Should I then say, no, it's not because you can't reproduce it?
So there's so many dimensions in this problem that makes it, it's not easy to dismiss anything
with AI or not AI, because I want to know about the security problems, but I don't
think it's a crap.
I wonder if you made some fun out of...