Conversation

Notices

1. Embed this notice
   lj·rk (ljrk@todon.eu)'s status on Tuesday, 28-Jul-2026 20:29:53 JST lj·rk

   in reply to

   • DrWhax
   • buherator

   @buherator @drwhax I sometimes advise investors (poor life choices I guess) on how to deal with the increased risk of Mythos & others. And this was the bottom line.

   I don't even need AI specifically to argue for that. The time-to-exploit has been dropping forever. We've built better catalogs and more versatile infrastructure and complex automations. It's very clear that this includes vuln research as well.

   We had this already with static analysis hitting the field. We answered with "shift left": Building security into the dev process, since the earlier you do it, the less issues you'll end up with. Every step earlier has more downstream impact.

   We've finally reached the stage where security as part of your design & architecture is not only best practice but becoming a hard requirement. Our automations (including LLMs) pushed us there and we need to deal with the outcome.

   Or should. Because I'm a cynic and I've seen what's happened, I doubt that engineering will follow through with this. I see two paths and we'll move along both, and I don't like either: Acceptance and few centralized Oligopols.

   1/2

   • Embed this notice
     buherator (buherator@infosec.place)'s status on Tuesday, 28-Jul-2026 20:29:54 JST buherator

     • DrWhax
     @drwhax Maybe the advice of the wiser among us will be heard after all these decades: focus on robust mitigations and attack surface reduction, because the moles can't be whacked anymore.
     es0mhi repeated this.