Top
Best
New

Posted by pseudolus 5 hours ago

AI is forcing us to pay off 40 years of technical debt(spectrum.ieee.org)
505 points | 345 commentspage 6
anovikov 3 hours ago|
It also inflated almost all of that debt away, though. So in a way people who built "just ship it" buggy things in the last few years, made the right bet.
jmyeet 4 hours ago||
I think we'll look back at this moment as peak C/C++ before they begin a long, slow decline into irrelevance.

I've been bullish on Rust for years because memory safety is simply too important and Rust can essentially prove an implementation correct and solve a certain class of very important bugs. It doesn't solve every problem and there is a complexity cost.

I've also said that writing multithreaded code is simply too complex. In an era of out-of-order execution, different levels of caching, asymmetric cores, hyperthreading (although this is largely dead now?), branch prediction and having to support multiple architectures it's simply too hard for most people to write correct multithreaded code. Period. If you find yourself as a non-library developer creating a mutex or spawning a thread, somebody has screwed up.

This is also why I think the single-threaded async/await model with post-request teardown of PHP is the correct choice for most people.

We're going to go through a dark period of a lot of 0days. As the article notes, this is paying 40 years of technical debt. It will result in a more secure ecosystem however. I believe this will ultimately also hamper black markets, governments and 3 letter agencies who trade in those 0days.

As painful as this all is, it will ultimately be a good thing, one of the few to come out of AI (IMHO).

SoftTalker 2 hours ago|
Spawning a thread can be pretty safe, if there's no mutable shared state.
TheRealPomax 2 hours ago||
> PHP, which originally stood for “personal home page,” is a programming language created back in 1994 and largely used by legacy sites.

Wow. Love it or hate it, but tell me you have no idea what PHP's place in the web ecosystem is without telling me you have no idea what PHP's place in the web ecosystem is.

arbor-group 1 hour ago||
[flagged]
rahulsawhneyonl 1 hour ago||
[flagged]
lvyafei 2 hours ago||
[flagged]
marsven_422 2 hours ago||
[dead]
honkostani 4 hours ago||
[dead]
LoboxPlatform 4 hours ago||
[flagged]
LoganDark 4 hours ago|
The PHP situation was only particularly bad because (of the nature of the vulnerability, but also) the people handling it made some very inappropriate choices, like being way too attached to the embargo even once the complete reproduction was circulating publicly on Twitter. That's not inherent to the security patch process, and hopefully doesn't become the norm.

Keep in mind that every PHP application globally was advised to completely cut network access or entirely shut down until the patch was available, so this was global critical infrastructure failure. I'm surprised lives weren't lost as a result.

And no, from what I've seen, it had nothing to do with the few entities that did rightly ignore the embargo after the exploit was already being circulated, even though the PHP devs are seemingly still putting resources into spinning it that way.

I'm sure the defender community will eventually come up with a way to patch security vulnerabilities just about as fast as they can be discovered and exploited.

sam_lowry_ 3 hours ago|
Why are we even discussing this article? Do you know who Dina Genkina is and what are her contributions to the field?