Summary
Highlights
Linus Torvalds observes a significant increase in commits to the Linux kernel over the past six months, attributing this surge to improvements in AI tools making them good enough for a wide range of developers. This has led to a 20% rise in contributions compared to previous years, lowering the barrier to entry for new developers. However, this also introduces new challenges for maintainers.
Torvalds admits to a 'love-hate' relationship with AI. While he finds the tools technically useful and interesting, they are causing pain points by forcing changes in established workflows. He compares this paradigm shift to a similar painful episode 25 years ago in kernel development, where scaling issues forced him to change his work methods. AI-generated bug reports and code are creating social issues and challenging existing community processes.
A significant pain point has been the security mailing list, which became overrun with duplicate bug reports identified by AI tools. Many users, finding bugs with AI, would immediately send them to the security list, often without realizing the issue was already known or that other AI users had found the same bug. This led to a policy change: any bug found with AI should be considered public, as numerous others likely found it simultaneously.
Torvalds explains that due to AI's ability to quickly identify bugs, the traditional process of privately fixing security issues before public disclosure is no longer feasible for AI-discovered vulnerabilities. The speed at which AI can find and re-verify bugs means that once a fix is committed to an open-source project, a public explanation of the vulnerability often appears within hours. This leaves maintainers with zero time between a fix and public knowledge, pushing them to be constantly on the back foot.
Despite the social and organizational challenges, Torvalds maintains an optimistic view of AI's overall impact. He believes that AI finding bugs, while creating short-term pain, ultimately leads to a better, more secure product. The real problem, he argues, is the bugs that remain undiscovered. He emphasizes that the conflict isn't with AI itself, but with the 'social choke points and pain points' that arise from integrating this new technology into existing development communities.