I'm personally not sharing the connotations of negativity towards software development and the term technical debt. I keep reading implications that most of this has always been in some way preventable, but it really is not that simple. How did nobody find these types of exploits 40 years ago? Why are we suddenly shocked and blame the field for this? I think the majority of people severely underestimate the complexity and seriousness of software. Once that perception stops and the economic incentives are right, we can start to look closer.

Just consider how laughable some working conditions in software are and then come to realize how architecture is shaped by the organization communication patterns and not reality. You will see it in a different light then.

And that's the biggest win with AI. With old-fashioned development, it was considered acceptable to defer addressing valid feedback ad infinitum, hiding behind whatever lousy excuse you could come up with. No more.

Of course no vulnerability has ever been found by a human or by fuzzing.

AI does find things, but it is a small percentage the overall vulnerabilities.

IEEE is of course and industry owned organization that shills for BigAI, NSA and any other entity with money or influence.

The amount of e-mails I get of the form "Important information regarding your xxxxx account" (which essentially is just code for "we've been hacked and your data has been stolen") is quite concerning, but not surprising. Security by obscurity was always big in most companies, as long as the bar to carrying out sophisticated attacks was putting a costly IT professional to the task you could be relatively relaxed as no one would bother to hack your stupid little e-shop, but now carrying out such an attack costs a few cents to a few dollars at most, that changes the game entirely and everyone is a target.

This summer I had my Docker registry poisoned with malware artefacts, which again is something that no sane attacker would do before as it required downloading my images, carefully modifying them and then overwriting them, ensuring they work as before. Now it's just a simple prompt away. I am definitely ramping up my defenses, everything that doesn't need to be Internet connected goes behind double VPN and port knocking schemes, essentially making my infrastructure invisible from the outside, all unknown packet types get hard dropped, end-to-end encryption of all internal traffic, web endpoints behind CDN proxies and WAF providers (as much as I hate doing that), double and tripe security mechanisms everywhere, maximum restriction of privileges, ultrafast automated patching and AI based continuous monitoring, audits and interventions. You should also get used to that, this will surely still get much worse as attacker tooling gets better.

And you know how are those technical debts created in the first place? More than 40 years of negligence in IT infrastructure.

I'm not going to lie, I'm having a great time thinking at the endless discussions around unsafe languages and the relentless smugness of many practitioners claiming everything was fine as long as the responsible and the skilled (them) were in charge; and let's not forget the formulaic "with great power comes great responsibility" closers.

Well now, Great Responsibles, it's clear you too were out of your collective depth and were all paying for your smug hubris. Perhaps take a bite out of that humble pie you've obviously never tasted?

Why are we even discussing this article? Do you know who Dina Genkina is and what are her contributions to the field?

We've patched more bugs and more vulnerabilities in the last 3 months than entire years at my last job.

I fear it's only going to get worse.

I'm sure the NSA has an eye on the groups that are asking AI about security issues in various popular softwares ...

Better sooner than later, to be honest.