Re: Exim 4.100-RC2 released

50 cents:

I personally saw one of the LLM "findings" last year, and checked the 
code out of curiosity, and saw directly that it had been a false alarm.

The report was sending a code fragment that, for itself, suggested, that 
a variable content was not tested and used in an insecure way.

With just ONE prev. line of code more, that reporter could have seen, 
that his report was nonsense. He/she did not check that him/herself, so 
he/she sent the nonsense report in a matter, that made it look 
important, which it wasn't at all.

This kind of reportss eats developers time at best, but frustrates in 
the worst case to a  point, where our devs have no interest anymore in 
going on. Nobody wants this, and that is (most likely) one of the reason 
for the ai rule.

Mike on the other hand has checked his finding and backed it up with a 
valgrind report, so he cared for the quality of this report. He could 
have sent it as a normal bug report, because of his well doing.

The Devteam should make the rule a bit clearer i.E.: AI is ok to 
initially find a bug, but the reporter needs to make sure it's not a 
hallucination by backing it up with manual tests and proofs.


best regards,
Marius

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki