Login
You're viewing the discuss.systems public feed.
  • hexHex@kolektiva.social
    Oct 24, 2026, 4:12 AM

    Security engineers, myself included for a long time, tend to have this naive idea that signal is what matters in tooling. If we can just make our signal clean enough, if we can just make sure people only know about what really matters, that devs and operators will fix the right things.

    False positive rate becomes a signal. We strive to give only the cleanest information. If we do so, we will be able to get everything fixed. Unfortunately, this is not true.

    Any system will incentivize or disincentivize certain behavior. Today, we push devs to make things and operators to manage more stuff.

    There is only a certain amount that you can ask them to fix before they burn out. It doesn't matter if it's all real stuff. At a certain volume of work, people stop.

    The reason we filter is not because a good enough filter will make sure everything is fixed. We filter because there's just a hard limit on how much can get fixed, so we can only push for important stuff.

    💬 1🔄 2⭐ 0

Replies

  • hexHex@kolektiva.social
    Oct 24, 2026, 4:24 AM

    We are seeing the results of a decades long extraction from open source, where markets have driven more to be built while externalizing the cost of review and maintenance.

    (If only someone could have told us that invisible labor is devalued under capitalism. If only there could have been some voice there to speak up and tell us that. What a tragedy that no one, decades and decades before the creation of the open source movement, said exactly that thing.)

    It's amazing that now, with "AI", capitalism has done the most paradoxical thing of providing support in an extractive way. Even dumping money into security and auditing stuff (the thing we *NEEDED* the whole time, the thing they just never did, the thing that was always written out as "out of scope") is being done in a way that extracts value and destroys the resources on which it relies.

    We have to understand that there are invisible commons everywhere. Just because they aren't physical, doesn't mean they aren't real. Open source is a commons. Trust in security is a commons. If these commons aren't managed, they will be mined and destroyed.

    One thing capitalism does better than anything else is colonize commons and destroy them. If there's any way to get value out of a commons, capitalism will worm it's way in and hollow the thing out until it collapses.

    💬 1🔄 6⭐ 3
  • hexHex@kolektiva.social
    Oct 24, 2026, 4:41 AM

    Humans build things and care for each other. This is what we evolved to do. It's something we're driven biologically to do, and we feel bad when we don't do it. That bad feeling is every ancestor who survived through mutual aid burying every ancestor who died from competition.

    We build commons. Capitalism is a system that maximizes the extraction of value. Looting commons, be it land or water resources managed for generations, or a tradition of information sharing built up over generations, or systems of trust built up over decades, capitalism is a machine that turns shared wealth and shared costs into centralized wealth and externalized costs.

    Capitalist markets are basically a genetic algorithm that uses wealth as a fitness function. One of the properties of these algorithms is that they will have side effects. Destroying commons is an unavoidable side effect. Every possible common will be destroyed until we choose a better algorithm on which to base our society.

    💬 1🔄 22⭐ 0
  • Alex / catilepticcatileptic@chaos.social
    Oct 24, 2026, 7:32 AM

    @Hex loved the last few lines of this post 💚

    the thing that frightens me is the narrative that defenders & maintainers must also use AI to secure and patch, because the attackers are using AI to try every possible option / exploit

    which scares me because both sides are deprofessionalizing themselves

    automated, "throw it at the wall" attacks aren't guaranteed to work just because of the high volume

    and "defending" with genAI only creates more vulnerabilities & tech debt

    💬 1🔄 2⭐ 0
  • 💬 0🔄 0⭐ 1