That's not what I said, nor is it what I meant. It is incredibly easy to write radically safer software than the standard. Moving code into gvisor virtually eliminates privilege escalation. Using memory safe languages without serialization is pretty straightforward. Using type safety to enforce security constraints is straightforward. Setting up network controls to limit SSRF is straightforward.

I could go on and on. A tiny bit of forethought and effort pays off massively.

> Piece of cake.

If everyone could convince management to care about security over "productivity" (read as number of marketable features squeezed out of organizational orifices per unit time), and maybe wire-up open-weight agents to do security critiques, we'd all be in a much better place, but Altman won't like that.

No we just need developers to do the bare minimum of effort to write secure software. Most hacks are not super complicated vulnerabilities chained together, but just utter failures where authentication and authorization was simply forgotten or untested, or where nobody bothered to validate the data they receive.

The bar for software is so low that it is embarrassing for the entire profession.