Re: LLMs - was Re: Re: Exim 4.100-RC2 released

Mike Cardwell via Exim-users <[email protected]> Fri, 07 Aug 2026 16:49:53 +0200
Newsgroups	gmane.mail.exim.user
Message-ID	<[email protected]>
On Fri, 2026-08-07 at 14:06 +0100, Andrew C Aitchison via Exim-users
wrote:
> 

> > It looks like you don't accept LLM submissions, but I pointed
> > Claude at
> > 4.100 and asked it to find problems that have been introduced since
> > 4.99. Here are a couple of the things that it found, which I tested
> > and which look legit to me. Take it or leave it,
> 
> Ii is not up to me, but I think that the point is that submissions
> will only be accepted from *people* who are *able* to take
> responsibility for their submissions.

Depends what responsibility means. I don't want to be an Exim dev. I do
want to run secure software. Testing acceptance of the submission was
part of why I sent the email. It seems this sort of submission is
considered "bad faith", so I wont do it again.

> Script-kiddies can get LLMs to report problems, but
> at present we don't know whether we can trust the LLM not to generate
> false positives faster than we can identify them, and
> script-kiddies cannot always be convinced that a false-positive is a 
> false-positive.
> 
> Both of these issues take up developer time without improving the
> program.

Yeah, I understand the problem. Hence why I pointed out that I tested
the bugs and they seemed legit, rather than just telling claude to open
bug reports for things it finds.

> > I don't care about attribution:
> 
> Hmm. If you take responsibility for your submissions,
> I think *we* *need* to put your name on them. Can we ?

I don't care either way. I wrote that sentence because SECURITY.md in
the Exim code base contains the following line, presumably to deter
people who are just trying to get their name on things:

> Reports we believe are LLM generated will either be rejected outright
or if thought to be plausible will be credited to the unnamed and
uncredited authors whose works were ingested as the training corpus.

Mike


-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki
signature.asc (application/pgp-signature, 525 B)