2026-08-09 18:56 UTC
@drwhax@infosec.exchange Who is going to provide the models and the time necessary for people running it and creating fixes? This is asking F/OSS maintainers to donate their personal time and money to Anthropic and OpenAI.
This won't be a one-time cost either: every time a change is made it would have to be re-run and outputs filtered for false positives. This creates a tax on society without solving underlying problems.
Why can we fund this but not efforts to eliminate the security holes entirely?
Replies (1)
-
@drwhax@infosec.exchange 2026-08-10 00:51
@zimzat@mastodon.social I totally hear you on this. It would be great to instead make funding available to squash entire bug classes. I think for a lot of projects, this would be great and I think the right move. I think it boils down to, security costs money and doesn't deliver, "return on investment" in a lot of CEO eyes, so it's not worth investing too much money on. The only thing I can point at right now is that OpenAI gives away some API tokens as donations for open source maintainers: https://openai.com/form/codex-open-source-fund/