Which options are there, really? There is re-write, fixing, and mitigation.
We have a lot of legacy code that probably contains many bugs that could be exploited.
We could either stop using that legacy code, i.e. re-write and move to a newer library / package. Or fix the old code.
I now believe that "fixing" the code is actually in reach for an organization such as Google, which has deep pockets, frontier AI models, and a history of working on open source. Spend a few billions to walk through every package that runs on a common Linux installation, find potential issues and robustify the code.
alt Hacker News
Which options are there, really? There is re-write, fixing, and mitigation.
We have a lot of legacy code that probably contains many bugs that could be exploited.
We could either stop using that legacy code, i.e. re-write and move to a newer library / package. Or fix the old code.
I now believe that "fixing" the code is actually in reach for an organization such as Google, which has deep pockets, frontier AI models, and a history of working on open source. Spend a few billions to walk through every package that runs on a common Linux installation, find potential issues and robustify the code.