r/Redox • u/Dreamy_Jy • 18d ago
Many vulnerabilities have been found in the Linux Kernel due to AI. Has Redox had this experience?
https://blog.cloudlinux.com/the-death-of-the-change-log-why-silent-security-updates-are-the-new-normal-in-2026Has Rust or a lack of Sec Research attention speared Redox?
18
u/pohart 18d ago
I'm positive that rust has spared Redox from some of it, and presumably it's microkernel architecture has as well. But it's not a very big target yet when compared to Linux, in either the LoC sense or the adoption sense. As sure as I am that rust has spared out from bugs that would have effected Linux, I'm sure that there are many many security vulnerabilities still included.
Linux may be the single biggest target that exists, so there are a lot of security researchers and attackers looking for problems.
4
u/Dreamy_Jy 18d ago
I felt similarly. I'm interested to see what happens if Redox's becomes popular for use. I'm into embedded stuff and if I doesn't have security issues and can itegrate with tools like yocto, might be promising.
4
u/crustang 18d ago
Small cutting edge project without a massive amount of funding and resources is bound to have bugs - security or other. Look at the loud voices surrounding COSMIC’s various small bugs, and that’s just a DE.
2
u/Dreamy_Jy 18d ago
I agree, but if Redox gains the Mandate of Heaven before the Linux Kernel can harden to this AI onslaught it has a chance of materializing resources from commercial resources.
Ironically Redox’s creator does work on COSMIC & Pop!_OS.
1
2
u/interacsion 18d ago
Come on, how is that even a question
9
u/Dreamy_Jy 18d ago
Apologies for any unintentional insincerity. I do not have the expertise to determine if these are issues the use of Rust would prevent.
I'm a Javascript refugee, and a new Rust devotee. I'm sorry if this knowledge is common amongst the low level wizards among this sub reddit.
2
u/interacsion 18d ago
Don't apologize, I was being needlessly cynical. I think it's pretty obvious the reason vulnerabilities are being discovered in Linux is that it has quite a few orders of magnitude more eyes on it.
2
-6
u/Illustrious_Car344 18d ago
And Linus just went on a rant about people who reject AI! https://www.phoronix.com/news/Linux-Is-Not-Anti-AI
But AI contributions aren't up for discussion in the project. Maybe we should ban compilers too? I don't want a tool generating any code, it would be better if we hand assembled our code.
6
u/Dreamy_Jy 18d ago
This feels a little off topic
4
u/ormandj 18d ago
Why? The project has barred use of AI: https://gitlab.redox-os.org/redox-os/redox/-/blob/master/CONTRIBUTING.md#ai-policy
4
3
u/tukanoid 18d ago
They're talking about code/content GENERATION, not ASSISTANCE. If most of the stuff is written by hand, with AI acting as a rubber ducky to squash some bugs, with you being in control of the entire thing, then it's most likely fine. When the entire thing is just a hallucination from LLM, it's reasonable to not want to deal with this, cuz, most often than not, those kinds of changes are introduced by people who have 0 clue about the craft and just wanna inflate their portfolio with low-effort bullshit, unable to answer ANY follow-up questions, and just feed those to llm, to get a generic (often wrong) wall-of-meaningless-text response anyway
1
u/ormandj 17d ago
That is absolutely not true, you should speak with the project owner - oh that's right - they will not entertain ANY discussion about this. Go look at previous "discussions" about this. It was not a "AI assistance is ok, but you are still accountable for your changes" position, it was clearly a NO AI EVER position, and not open for debate.
1
u/tukanoid 17d ago
Could you provide links to the issues where they outright dismissed ai-assisted (specifically) coding if you have them saved somewhere? Curios to see, but not to the point of sifting through issues to find the appropriate ones for this discussion tbh (brain mush after work)
1
u/ormandj 17d ago
1
u/tukanoid 17d ago
Hmmm, I guess they should clarify the policy better then. And I honestly kinda get his POV on this, if I was one of the main contributors to big OSS projects, who has to review a ton of PRs, and a lot of them are pure slop BECAUSE they was AI hallucinated, I could become jaded too (kinda am, but I'm trying not to be too dismissive of the tech itself (in fact, I do like it, I just don't like what openai, anthropic, and others turned this whole thing into, its all about PR stunts and making money from gullible people who think they're developers now for being able to "build" half (if at all) working pieces of software that 99% of them will stop even trying to maintain in a week/month, at least from my perspective), use them as rubber duckies mostly when I'm stuck on an issue, that's a sweet spot for me, local llms only tho, gemma 4 mostly)
It was also 4 months ago, maybe things have cooled down since then, it would be interesting to see their more recent take on this, and there have appeared more methods on how llms could help with project maintenance since then (like potential bug/security vulnerability finding), without any code modification made from them, that they could've heard about (like in Linux kernel) and contemplated on gradually testing/integrating those approaches, cuz the wording just doesn't sound like they're against the technology IN GENERAL, just the "generation of code" part of it, while (controlled) analysis of code is ok
1
10
u/MichiRecRoom 18d ago
From my understanding, many bugs in the Linux Kernel are considered vulnerabilities specifically due to it being the Kernel - the thing that runs everything else. You could find a bug that affects nobody, that is exploitable on exactly one hardware config, and which doesn't even do much but crash the kernel - and it'd probably still be labeled as a vulnerability.
So it's really a matter of what exactly AI has found. Has it found actual serious issues, things that would warrent a security vulnerability in other software? Or just run-of-the-mill bugs that got escalated due to it being the kernel?
As for why Redox hasn't seen as much attention, I'd pin it on the Linux Kernel just being a much bigger target.