alt Hacker NewsThe security debt is temporal and going to decline because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I'm very positive about the change. If we don't look at it purely technical, vermin from ransomware gangs and Russian/Israeli/USA spy agencies already knew a subset of these things. That shows how vulnerable we were, actually. What's a stupid bug for one, might be life and death question for another. Before, from business side of things, there was no urgency to maintain proper security and fix things, now we have a more equalized grounds and everyone has to invest both in security assessment, sandboxing/better isolation on system level and formal verification.
That will literally improve small countries and individual sovereignty against the spies and improve the humanity in the long term.
While it's a pity for many maintainers during the transition, after some time we will have much better world where you can trust your computer regardless of who you are.
> because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I highly disagree with this, I've worked in many environment and I can tell you some medium/big companies do not adapt fast enough, some have multiple projects, and when someone critical leaves, many of these projects remain unmaintained but "working". If you don't have deep monitoring, you won't even detect that you've been "hacked" or "infiltrated". Companies accepted that risk because the pace from CVE -> exploitation was big enough, but now with AI, exploitation at scale is easier than ever.