Comment by dmantis
3 hours ago
The security debt is temporal and going to decline because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I'm very positive about the change. If we don't look at it purely technical, vermin from ransomware gangs and Russian/Israeli/USA spy agencies already knew a subset of these things. That shows how vulnerable we were, actually. What's a stupid bug for one, might be life and death question for another. Before, from business side of things, there was no urgency to maintain proper security and fix things, now we have a more equalized grounds and everyone has to invest both in security assessment, sandboxing/better isolation on system level and formal verification.
That will literally improve small countries and individual sovereignty against the spies and improve the humanity in the long term.
While it's a pity for many maintainers during the transition, after some time we will have much better world where you can trust your computer regardless of who you are.
> because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I highly disagree with this, I've worked in many environment and I can tell you some medium/big companies do not adapt fast enough, some have multiple projects, and when someone critical leaves, many of these projects remain unmaintained but "working". If you don't have deep monitoring, you won't even detect that you've been "hacked" or "infiltrated". Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.
> Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.
So that's what I'm saying, the business incentives are changed, there is no more room for the ignorance of the security. You either maintain it or you are out of business. Brutal period, but now everybody is forced to update, fix and improve the isolation because every script-kiddy can deploy a 0day every week. That helps to fix things against actually dangerous actors who had resources for 0days before the AI boom and used this negligence to harm people worldwide.