Do you want a CVE?

[wordshaper@weatherishappening.network]

@atoponce I am again reminded that the best thing we can do is figure out what devices, services, and apps these "fuck quality, full speed ahead!" choads are using and surface every single bit of their data publicly.

[traecer@techhub.social]

@atoponce
this is DEFINITELY how you get a CVE

[skjeggtroll@mastodon.online]

@atoponce

First of all, it's a _quarter century_ since we left the 90s and the Internet boom, and these money-grubbers are still stuck on chasing the high of that era's first-to-market success stories. Stop it. It doesn't work like that any more.

Secondly, while there's truth in the adage that "perfect is the enemy of good enough", do you know what's also an enemy of good enough? Sloppy work and bullshit.

[nemith@hachyderm.io]

@atoponce I love how people just forget that keeping a service running is as/more important that writing new feature.

Anyone who comes upw with the opinion apparent has never worked in a operations role.

[hopeless@mas.to]

@atoponce I get CVEs without AI, despite my best efforts.

If you create new code, some proportion of it will have security problems, even purely manually. What's the point of pretending only AI causes CVEs, it's obviously false.

We manage our manual failures by static analysis and fuzzing to try to find the flaws first. That will also work with flaws introduced by AI, right?

Services like Jules are becoming workable. I'm afraid we are all going to have to adapt to that.

[atoponce@fosstodon.org]

@hopeless No one is assuming only AI slop creates CVEs, including OP in the screenshot. Slop is slop, AI or human.

OP is being disingenuous. He's defining slop as AI or human generated, while comparing it to perfect code instead of quality code. I'm not aware of any company with "perfection assurance" departments.

But "release early, release often" is exactly the mindset that produces CVEs and technical debt.

[f4grx@chaos.social]

@phl @atoponce yes and I find this disappointing. It tells me that many people got into tech for money and actually hate coding.

[rrwo@infosec.exchange]

@atoponce @odoruhako

The point for some people is to sell the company before the technical debt comes due.

[bit101@mstdn.social]

@f4grx @phl @atoponce this cycle happens on every bubble. I, like many others started coding for money in the late 90s. I'm still doing it. A lot of the people I knew then jumped ship as soon as the dot-com boom busted.

[loke@functional.cafe]

@f4grx @phl @atoponce this is the truth in my opinion. There is a portion of people who enjoy it, and they tend to be good at it. It's just that by the 90's we were running out of people who enjoyed it, but coders (in the original sense, as opposed to programmers) were still needed. Hence, code camps, etc.

The llm craze is just a continuation of this. But now you have the drawback that none of the people doing grunt coding will have the opportunity to discover actual programming, meaning we'll have a severe lack of senior developers soon enough.

[oblomov@sociale.network]

@traecer @atoponce TBF you don't get *a* CVE this way, but more likely several. Per line of code.