Potentially interesting sources I've found:
https://community.sap.com/t5/security-and-compliance-blog-posts/code-that-breaks-the-law-ethics-and-legal-challenges-in-ai-generated-code/ba-p/14465494
https://www.csoonline.com/article/4210735/ai-can-find-zero-days-but-still-cant-reliably-write-secure-code.html
https://www.softwareimprovementgroup.com/wp-content/uploads/State-of-Software-2026.pdf
https://www.veracode.com/resources/analyst-reports/2026-genai-code-security-report/report/

Fediverse folx, I need your help against generative AI for software development.

My employer wants to pivot hard into agentic AI and eventually "dark factory". Do you have hard facts and data regarding costs, speed, code quality, vulnerabilities, tech debt and the like, similar to the recent 1password blog post (https://1password.com/blog/why-ai-generated-patches-still-require-human-review)? Any input that is useful for arguments against it are much appreciated, even more so if these are metrics that management types care about.

For context: My employer is basically shitting bricks because they are worried that competitors will eat their lunch by quickly building products with similar features leveraging GenAI. Engineering is overworked with tasks. C-level is unwilling to spend budget on hiring more people. Shareholders apparently want GenAI.

#NoAI #ai #genai #slop #agentic #dev #devops #devsecops

Bitwarden CLI has been compromised in a supply chain attack that targeted KICS. #bitwarden #kics #malware #supplychain https://socket.dev/blog/bitwarden-cli-compromised

Obviously not to be taken very seriously. You will push people in general away from using your software.

Shower thought I had today: If you want to prevent your software from being used against your wishes by large companies or government agencies, it would probably be far more effective to call it something rude or politically charged rather than applying a dual license on a source available software. Like naming it the "DEI-LGBTQ-Cocksucker-Tiananmen-1989" v1.3.2-rc.1. I bet you wouldn't see that used much in the U.S., Russia, or China no matter how great the software is. Those that do use it still would probably honor the license. #showerthoughts #oss #opensource #licensing

Do any of you have suggestions for managing SBOM and license compliance with OSS solutions? I've looked into DejaCode and ScanCode[.]io. DejaCode makes a good first impression but has some serious limitations when it comes to SBOM processing (supported format versions, handling of hierarchies). I would like to use something that allows a review process and handling of more complex licensing (e.g. dual licensing, SPDX expressions) before generating the final SBOM. Basically what DejaCode does but with better SBOM handling. #sbom #cra #compliance #license #foss

After the XZ backdoor incident Lasse Collin shows surprisingly good humor in the commits and commit messages that fix the mess that "Jia Tan" has caused.

Update to the authors of XZ:
"Special author: Jia Tan was a co-maintainer in 2022-2024. He and the team behind him inserted a backdoor (CVE-2024-3094) into XZ Utils 5.6.0 and 5.6.1 releases. He suddenly disappeared when this was discovered."

On why the backdoor was removed:
"- On machines that see lots bots poking at the SSH port, the backdoor noticeably increased CPU load, resulting in degraded user experience and thus overwhelmingly negative user feedback. - The maintainer who added the backdoor has disappeared. - Backdoors are bad for security. "

https://github.com/tukaani-project/xz/commit/77a294d98a9d2d48f7e4ac273711518bf689f5c4
https://github.com/tukaani-project/xz/commit/e93e13c8b3bec925c56e0c0b675d8000a0f7f754

@emjric in case you've got an account on Hive Social too, you may want to remove any sensitive PII from there. Security researchers have found severe vulnerabilities that allow to access information like DMs or the phone number and email address used for account registration. https://chaos.social/@zerforschung/109434915173065283