Page MenuHomeVyOS Platform
Create Task
Maniphest T9465

Request to Consider VyOS 1.5 for Anthropic OSS Scanner Security Review
Open, Requires assessmentPublicFEATURE REQUEST
Actions

Description

Hello VyOS Support Team,

First of all, I would like to thank the entire VyOS team for your excellent work on VyOS. I truly appreciate the quality, flexibility, and reliability of the project, and I am grateful to be able to use such a great product in my own infrastructure.

I am currently running VyOS 1.5 (Circinus), and as someone who relies on VyOS for my network infrastructure, I naturally care a great deal about its security.

I recently learned about Anthropic’s OSS Scanner, a tool designed to help identify potential security vulnerabilities in open-source software. I wanted to ask whether the VyOS team would consider submitting VyOS 1.5 for analysis by this tool.

I believe an additional independent security review could be beneficial to the project and its users by helping identify potential issues and further strengthen confidence in VyOS.

I understand that participating in such a program takes time and effort, and I sincerely appreciate the ongoing work that goes into developing and maintaining VyOS. Please take this suggestion simply as a sign of appreciation for the project and my interest in helping make it even more secure.

Thank you again for your great work and for providing such a valuable product to the community.

Best regards,
A grateful VyOS user

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Related Objects

Event Timeline

bmstu2208 created this task.Thu, Oct 15, 5:16 PM
bmstu2208 created this object in space S1 VyOS Public.
pasik subscribed.Thu, Oct 15, 6:55 PM
Apachez subscribed.Thu, Oct 22, 6:32 AM

Im guessing the comment from closing my task of results from Lynis scanning 3 years ago still remains?

Result of system audit by Lynis
https://vyos.dev/T5549

<dmbaturin> Since the task as worded is no actionable, I'm closing it as invalid. I'm not against using any tools that might help us, but we need to be sure what the task is (e.g., to implement regular scanning, or to fix specific suggestions from a scan...).

There is also this to consider when evaluating "AI" (posted 2026-10-20):

https://www.phoronix.com/news/Linux-Foundation-25p-AI-Slop

The Linux Foundation published a new study today around the impact of generative AI on open-source software development. One key takeaway is that ~25% of new open-source software pull requests amount to AI slop.

...

Very concerning though, their research found that 25% of incoming pull requests are estimated to be low-quality AI slop across open-source projects. Presumably that number will, sadly, continue to rise as more newcomers and users embrace AI/LLMs for working on patches on their behalf.

As long as you dont blindly trust AI/LLM its no different from static/dynamic code analyzers or vulnerability/system scanners - a human must go through the result(s) and verify them before creating tasks so the fixes actually fixes things and not break things even further.

If you want to use AI/LLM for something then perhaps you could ask it on how to resolve this case as a starter? ;-)

Something is fishy with commit and boot times when more than a few hundred static routes are being used
https://vyos.dev/T5388

Ref:

https://www.linuxfoundation.org/press/new-lf-research-survey-shows-generative-ai-cuts-open-source-coding-time-in-half-but-25-of-incoming-pull-requests-are-considered-ai-slop