Good news: We’re rapidly making FOSS the most secure software ever.
Bad news: We’re doing it in the most painful way possible.
It‘s probably still much less secure than pre-AI FOSS simply because it didn‘t have to deal with that kind of attacks.
The way corporate software will survive is through absurds laws they lobby for and data centers, though. Because if they kept playing by the old rules of consumers owning devices they would lose to FOSS really quickly at this point. With so many vibe coded clones and all. But when the hardware becomes unobtainable for mere citizens most of us will get pushed further and further into the cloud and complete surveillance. I bet that‘s what they‘re betting on.
No, the vulnerabilities were always there, AI is just pointing them out publicly.
I used to work as a professional hacker. Let me tell you something that the news never, ever talks about: If a company doesn’t have a bug bounty program, we kept those vulnerabilities to ourselves.
A government has vast resources to do just that: Keep the vulnerabilities to themselves until they feel like using them. They will not disclose them. They will keep them in their back pocket until the day comes when they need them for an op.
The only time they disclose vulnerabilities is when they think they’re too easy to find and there’s a public interest benefit to getting the problem fixed (e.g. the government is using those products).
What this means is that AI really is making FOSS vastly more secure than it ever was. This is probably pissing off government red teams to no end.
What we’re not hearing about as much is AI finding vulnerabilities in closed source products. Not because it’s not finding them, but because the disclosures are kept private (because companies treat it as bad PR and they’re assholes about it).
You can bet your ass that AIs run by state actors are building up massive war chests of vulnerabilities in closed source products right now. We’ll only hear about them after these products get exploited and maybe not even then because so, so many companies have no idea WTF they’re doing in regards to infosec. Think about it: How many CEOs are right now demanding their teams reduce the amount of FOSS they use because of the recent news? These people are idiots and apparently never heard that old joke about a new employee making a $100,000 mistake… “We just spent $100,000 training them!”
B-b-but Fediverse users assured me this could never happen when AI started decompiling games in an industrial speed because „You don‘t have corporate software on your computer to decompile so it will be fine“ as if that was the point. AI is a brute force machine if nothing else.
No software is safe. Not your supermarkets. Not your bank. Not your hospital. We may soon stop thinking about software as an engineering thing and more of a gardening activity because it will just keep growing when unattended.
