alt Hacker NewsI don't think this is true in general. If you deploy a good ole web application with sufficiently locked down inputs and thorough input validation, the AI will not succeed. The security engineering of 10 years ago still works in this regard. But it requires discipline to build small, minimalist, well engineered software that you as a human actually understand.
Replies
As the TCP bug that surfaced a couple of weeks ago, that is not true, you depend on the kernel, your application runtime, and many layers of dependencies.
Many bugs live in all those layers that may undermine your ability to lock down inputs and outputs.
And then PHP (name your lang/OS/platform of choice) comes along and pulls your sufficiently locked down app into the gutter.
This is more fundamental than better input checking. Your compute substrate itself is flawed. Intelligence and speed is indeed the only thing between “safe” and “completely open”.
I fully agree it’s a good idea to be minimal etc but I don’t see it being sufficient in the long run.
And then your language has a gaping hole (PHP or NodeJS), or the box you're running on has a gaping hole (Linux), or the PaaS you use has a gaping hole (Railway). There are just too many layers underneath the good ol' web application to claim that AI won't succeed.
Honestly, at this point the best we have is to hope the whitehat AI scanning for issues is stronger than the blackhat AI.