The Era of Software Quality, or the Era of Ostriches?

What it is

Michael Catanzaro's blog post lays out a specific, actionable AI-usage policy proposal and concrete technical remediation for the vulnerability surge the existing summary describes. The core proposal: GNOME maintainers must rewrite AI contribution policies to explicitly permit AI-generated vulnerability reports, and any project that keeps banning them should be ejected as a GNOME dependency ("developed someplace other than GNOME GitLab").

How it works

The bug bounty's libsoup/GLib results point to a dominant root cause: integer overflow bugs leading to buffer overflow, which Catanzaro now considers the top risk category. His mitigation is a compiler-flag fix, not a code audit: -Wconversion/-Wint-conversion and -Wsign-compare. He notes some GNOME projects already use -Wsign-compare, but few or none use -Wconversion/-Wint-conversion.

On the AISLE/Red Hat GLib scan, the 40% false-positive rate traces to one specific misunderstanding: AISLE flagged 46 gobject-introspection typelib bugs as vulnerabilities, but maintainers agree a typelib must inherently be fully trusted (it's effectively a calling convention), so a malicious typelib causes harm regardless of bugs — these are real quality bugs but not security vulnerabilities.

What to do

• Rewrite AI contribution policies to permit AI-generated vulnerability reports (do not require reporters to rewrite reports in human language — it doesn't scale).
• Add -Wconversion, -Wint-conversion, and -Wsign-compare to compiler flags to catch integer overflow/sign-comparison bugs before they become CVEs.
• If restarting a bug bounty program, scope it only to projects that already run their own AI scans, and pay only for working exploits rather than every reported vulnerability.
• Do not use AI to write code comments, commit messages, or issue/MR comments posted as if human-written — his draft policy bans all three even though he grants AI may write better commit messages than humans.
• Avoid Rust for new GNOME code despite its memory-safety benefits: Cargo's dependency-download model is judged to carry supply-chain risk that "probably outweighs" the memory-safety gain.

Caveats

The 118-finding GLib count from AISLE is explicitly flagged as "not entirely trustworthy" — un-deduplicated and still being triaged at time of writing. Codean Labs' human audit found critical Flatpak/xdg-desktop-portal sandbox escapes that Catanzaro says AI likely would have missed, so the piece argues against AI-only scanning despite its endorsement of AI reports generally.