> Upon further digging, I discovered that WireServer was maintaining in-memory caches containing unencrypted tenant data, all mixed in the same memory areas, in violation of all hostile multi-tenancy security guidelines.
> It is conceivable that, with a little poking, an attacker could obtain data, including secrets such as certificates, belonging to other tenants on the node.
> Moreover, the code was leaking cached entries and even entire caches due to misunderstood memory ownership rules, and suffered from a large number of crashes, in the order of 300,000 to 500,000 crashes per month for the WireServer web server alone across the fleet.
Finding an easy solution to making spare money keep up with inflation+ is the problem. The default investment solution is to put it into some mixed fund, but if you drill into the moral implication of that who knows what clownery I'm funding. How can I invest and have a better then average expectation that the money won't fund something corrupt.
A friend asked me the opposite: would this be the moment things get serious?
As long as people are still using glass sliders and Schlage locks to protect their actual stuff, sec will continue to be looked at as black magic, like SEO, GEO, and unironically, CEO.
Seeing a problem and knowing what to do about it are two different things. I think it's pretty clear there's a huge job problem coming and not just in the IT sector. Other areas are also heavily affected already like customer service. Translators, illustrators.
In the long term this leads to significant societal disruption. Many people out of work, many won't be able to find work because this transition happens so fast. Previous major transitions like the industrial revolution worked out ok but they happened over generations. Not years.
And with so many people out of work there will be a lot less spending money on products causing a downturn. And less people paying taxes causing the government to be stuck for money.
I don't have the answers but I do see some big problems on the horizon.
Quit being passive - you’re asking folks to consider this, and deeply ponder the consequences, but what’s the action you’re calling for?
General AI ban? Managers guiding their firms not to use, to (artificially?) protect headcount? Individual contributors quietly quitting the demand to push more code than can be reviewed properly?
Say what you need to say - the way you’re going about it is worse than weird: it’s ineffective, and makes your view (whatever it actually is) look whiny.
Do you folks coordinate in the way described, and show success with it? (Would most people agree with you?)
reply